I’m talking about this article that I remember reading last year, but I never fully comprehend it. https://archive.md/qgBWB
Especially one of the images:
What does “BFU Extractions” mean? Does it just straight up bypass any lockscreen, even Before First Unlock?
The first time I came across that article, I just assumed if you have a strong password, your fine, now I’m not so sure, I’m starting to get a bit paranoid… 😖
ok, I feel password lock would be more secure in this case then since its harder to brute force. For some that might be worth the more of a hassle unlocking
Not necessarily. The longer the better. Most people use a 4-digit passcode or simple pattern. A long passcode, generated by a CSPRNG is probably the best. I don’t know how biometrics stack up.
Biometrics are worst than a pin in a situation where your phone us hooked up to Cellebrite, because most likely they can just take your fingerprints, or make you press the sensor by force. Or even worse with facial recognition, because they can just wave the phone in front of you to unlock it.
It’s generally not super good otherwise either, at least not as a reliable way to derive an encryption key while being tolerant enough to damaged skin and positioning and all.
Biometrics are a good compromise for daily convenience: most people care about if they lose their phones or it gets stolen, and a thief will just factory reset it and flip it especially of the full qwerty keyboard pops up. Biometrics are still usually backed by a PIN or password, so biometrics makes it bearable to use a strong password since you only need to enter it once every couple days. And that password is the encryption key, so in BFU state you’re safe.