I also was unfamiliar with the Secure Element component. My mistake, I thought I had heard it was a feature previously. You haven't explained the details on how you would want this to work, why you want this, in which threat model it makes sense and what it offers over the existing options. It can also be used for FIDO2 rather than needing a separate security key as long as apps support it. The secure element in the phones is far more secure than a YubiKey. Set a random 6 digit PIN and you have highly secure encryption based on the secure element in the phone. It has never been either a primary or even a normal secondary unlock mechanism, only a smart lock feature. Play services has had smart lock options which are a different thing than the primary and secondary unlock mechanisms supported by the OS. Or the other security holes that could potentially be created are of greater concern and this should't even be considered.Īndroid never supported this. I am sure those would also be prerequisets before making this a possibility.ĭespite not seeing any other issue numbers I can't imagine I'm the only one to think of this and there is something I don't know. I noticed issues #816 and #465 which seemed to be related. Would there be similar concerns of security holes over USBC?
Perhaps a warning or something could appear to inform users of the implications if it were in place? If that is the case and is possible I can see the issues then.
That said I am still not sure if that would constitute a risk just by having it on when locked even if you have no apps or only one that uses the ability. I have no wallet or other apps with those capabilities. However, I only use NFC for my YubiKey as is. With that in mind I'm sure it would technically lessen security. As I understand this is not supported for situations such as someone stealing your phone and using the wallet capability. It also appears that even in the base Android NFC is turned off when locked. I believe nfc used to be an option with Android that got removed/discontinued.
0 kommentar(er)
