search

GrapheneOS / os-issue-tracker

Issue tracker for GrapheneOS Android Open Source Project hardening work. Standalone projects like Auditor, AttestationServer and hardened_malloc have their own dedicated trackers.
https://grapheneos.org/
351 stars 19 forks source link

[Feature request] Force periodic reauthentication with password when the screen is unlocked #3869

Open bld5p7dw opened 1 month ago

bld5p7dw commented 1 month ago

Hi!

I think it would be beneficial for the security to have the option to force periodic re-authentication while the screen is unlocked.

Currently, if someone steals my phone while the screen is unlocked I don't have a way to stop him from accessing the data.

But having a system service that requires to enter a password every given time e.g. 15 or 30 minutes would add significant protection. It could show a notification 1 minute before locking the screen to ask for the password. If I don't enter a valid password, the screen is locked. The feature would of course be opt-in, only for users that need it.

To prevent dumping of the phone contents through the USB port, its access could also be protected with a password. Same with USB settings. So, for example, every time I connect a USB device I would need to provide a password before using the device.

Benefits:

  1. Someone taking an unlocked phone from your hand most of the time is not a trained intelligence agency person that will immediately start to extract data from the phone into a USB stick. So the protection would be useful in most cases.
  2. Even a trained person is still a human who can make mistakes. So having a 15 minutes countdown could be useful against such person as well and could protect the data on the phone.

I already proposed this feature it in the forum, but it went unnoticed, so I report it here to prevent it from disappearing.

thestinger commented 1 month ago

To prevent dumping of the phone contents through the USB port, its access could also be protected with a password. Same with USB settings. So, for example, every time I connect a USB device I would need to provide a password before using the device.

They can directly obtain the files via the file manager. There isn't really any more accessible via the USB port without enabling developer options, which requires the password.