Encrypt device and external memory card

[Casey Cheung]

Update here: After having my device and memory card encrypted for over a year, for the first time I had to do the un-encryption process yesterday. Why? Cuz I got a new Note 3 phone!! I took out the memory card from my old Note 2 phone and inserted it into my new Note 3. For over a half hour, I kept scratching my head wondering why my pictures and documents wouldn't show up. Then it occurred to me. Duh?!? I had encrypted the memory card from the previous phone! I had to put the memory card back into the Note 2 phone, do the un-encryption process which literally took 3 to 4 hours to finish! The length of time is probably due to my thousands of pictures and hundred of files. I was then able to re-insert the same memory card into my new Note 3 phone, and bam! It worked again! My Note 2 phone is still encrypted for the phone itself, but now the memory card is no longer encrypted. I'm debating if I want to encrypt my memory card again using my new Note 3 phone. Hmmmmm. Anyway, thought I'd give an update here since there seems to be interest in this topic.


Anyone using this encrypt device/memory caed security feature? Is it effective? Is it to much a hassle to decrypt device/memory card each time?

 

[kiwiruss]

My work forces an encrypt policy through exchange and it works seamlessly. No issues.

Sent From my Verizon Galaxy Note 2

 

[Casey Cheung]

My work forces an encrypt policy through exchange and it works seamlessly. No issues.

Sent From my Verizon Galaxy Note 2

How does the process work? Do you need to un-encrypt each time you want to access files from either internal or external memory? If so, does it take long?

Thanks,
Casey

 

[underdonk]

Very effective and very little performance impact - none perceptible in any real world tasks that I can see. The crypto is completely transparent to the user, with the exception of requiring a PIN to unlock the phone (after locking and upon boot). The crypto used is equivalent to that used to protect unclassified sensitive government information - that is to say it is strong from an algorithm selection standpoint, and seems to be a pretty solid implementation as well. For a device that goes everywhere with us that we sync all of our communications with, it seems to me to be almost a requirement these days.

 

[underdonk]

How does the process work? Do you need to un-encrypt each time you want to access files from either internal or external memory? If so, does it take long?

Thanks,
Casey

Just want to clarify - the encryption/decryption process happens on the fly with no interaction from the user. Think of it happening at a lower "layer" in the operating system. Any performance impact and additional battery drain happens because of this process occurring in the background. After the initial data encryption process when you turn it on in the settings menu, which will require a reboot and some waiting, you're good to go.

 

[Casey Cheung]

Just want to clarify - the encryption/decryption process happens on the fly with no interaction from the user. Think of it happening at a lower "layer" in the operating system. Any performance impact and additional battery drain happens because of this process occurring in the background. After the initial data encryption process when you turn it on in the settings menu, which will require a reboot and some waiting, you're good to go.

Thanks! My Note 2 just finished the device encryption process. You're right that there is no noticeable difference in speed of operation. Question: Must I now always enter a Password for device access? I prefer using my previous 4 digit PIN number. It's a little cumbersome having to enter in a password versus a 4 digit pin. Or must a password be used in order for the encryption/decryption process to work?

I'm also now in the process of encrypting my external memory card, and it's taking much longer since I'm encrypting everything including media files. The cool thing is that the message reads that once encrypted, the memory card can only be used in my device. That seems like good protection in case my phone is lost, and someone tries to access my external memory card.

Thanks,
Casey

 

[Casey Cheung]

I have an update here, just as an FYI. My Note 2 is now encrypted after competing the encryption process which took nearly an hour. It appears once encrypted, I must now always use the designated password each time I want to access my phone now. My password is slightly cumbersome to enter on the keyboard, as the requirement is for at least 6 characters plus one number. I tried to change from password security to PIN number security, but alas was not able to. It appears I would now need to DE-crypt the device if I want to go back to using a PIN number security instead of a Password. For now, I will just leave things alone, as I don't feel like going through another hour long process to DE-crypt my phone.

Casey

 

[underdonk]

Thanks! My Note 2 just finished the device encryption process. You're right that there is no noticeable difference in speed of operation. Question: Must I now always enter a Password for device access? I prefer using my previous 4 digit PIN number. It's a little cumbersome having to enter in a password versus a 4 digit pin. Or must a password be used in order for the encryption/decryption process to work?

I'm also now in the process of encrypting my external memory card, and it's taking much longer since I'm encrypting everything including media files. The cool thing is that the message reads that once encrypted, the memory card can only be used in my device. That seems like good protection in case my phone is lost, and someone tries to access my external memory card.

Thanks,
Casey

Right on! I am glad it's working well and you're not seeing a performance hit. I haven't looked into the hardware for the Note 2, but many mobile devices have special processors that keep the cryptographic operations off of the main CPU - I would imagine this is the case with these devices. You can enable a PIN for device access which is required when you are using encryption, I believe. You could in ICS, and I can't imagine they removed it in Jellybean.

 

[underdonk]

Interesting! If you try changing your password (not type, but the actual password) does it also need to decrypt/encrypt the device? FWIW, one of the primary reasons the device now requires a password every time you want to access it is that if it weren't the case, the crypto would be useless - someone could just pick up the phone and access the data on it (as the crypto is transparent to the person using the device after authentication). Crypto protects against attacks on the phone such as someone pulling out the SD card and trying to access it using a computer, or someone plugging in the phone to a PC via a USB cable and trying to access internal phone storage.

 

[bigguy_132]

Interesting I had the choice. I believe they can specify from the other end. I was either given a choice of a password or a pin. I was able to select a pin.

 

[Bobman]

I encrypted my device and only had the choice to do password. It is a little harder to put in then just a 4 digit PIN, but I suppose it is more secure. As, a result I turned off the feature to lock the screen immediately with the power button and made the delay 15 seconds. I will sometimes accidentally press the power button and this way I don't have to put the password in all the time.

 

[underdonk]

Great tip for this setup (re: encryption). Having used Moto phones almost exclusively since becoming an Android user, I am used to the power button being on the top, and I find that I regularly accidentally hit it on the GN2 because of the way I grip the phone. Gracias!

 

[Casey Cheung]

I'm glad other users can find this encryption process information useful. I've tried and tried and tried, but cannot switch from a password to a PIN now that my device is encrypted. I'm confident I'm not doing anything wrong, my device simply won't let me switch to a PIN unless I de-crypt the phone first. At this point, I'm still using my password for access, which is a bit more cumbersome since it requires the following steps: 1) Press power button to turn on screen, 2) tap the "Enter password" button for the keyboard to show up, 3) Enter the password which also includes one required number, then press done button. Samsung could have made this less cumbersome by having the keyboard show up immediately upon pressing the power button so that I don't need to press the "Enter password" button as an extra step. Plus the icon to the right of "Enter password" button for choosing either "Samsung keyboard" or "Swype" is rather useless for me because if I choose Swype, the numbers 1 through 0 don't show up above the letter keys. The numbers 1 through 0 only show up when using the Samsung keyboard. Since a number is required as part of the password for access, this makes the Swype keyboard rather useless. Anyway, I'm starting to get used to the extra hassle of entering a password instead of the simple PIN number for accessing my device. At some point in the future, I might change back.

Casey

 

[Casey Cheung]

I have an update here. Encrypting the external memory card really does work! I encrypted the memory card, in addition to encrypting the device. As a test, when I took out my encrypted Sandisk Ultra 64GB card, and placed inside my laptop to see if I can open any files, I simply received error messages on my laptop saying the file(s) cannot be opened. The laptop still does show the various folders in the memory card, including the names of each files (eg: Word files, PDF files, MP3 music files, picture/video files), but the laptop could not open the files. I'm impressed by this! I think I may just leave things alone the way it is now, even though I have to now enter a somewhat cumbersome password (versus a PIN number) for device access.

Casey

 

[Bobman]

I have an update here. Encrypting the external memory card really does work! I encrypted the memory card, in addition to encrypting the device. As a test, when I took out my encrypted Sandisk Ultra 64GB card, and placed inside my laptop to see if I can open any files, I simply received error messages on my laptop saying the file(s) cannot be opened. The laptop still does show the various folders in the memory card, including the names of each files (eg: Word files, PDF files, MP3 music files, picture/video files), but the laptop could not open the files. I'm impressed by this! I think I may just leave things alone the way it is now, even though I have to now enter a somewhat cumbersome password (versus a PIN number) for device access.

Casey

Interesting. Seems odd that you can still see the file names and folders. It is great that you can't open them, but it seems like you shouldn't even be able to get that far. Thanks for the update.

I actually haven't even put an SD card in my Note 2 yet. I'm sure I will eventually, but I haven't needed one yet.

 

[Casey Cheung]

Interesting. Seems odd that you can still see the file names and folders. It is great that you can't open them, but it seems like you shouldn't even be able to get that far. Thanks for the update.

I actually haven't even put an SD card in my Note 2 yet. I'm sure I will eventually, but I haven't needed one yet.

I was hoping that it wasn't even possible to open the external memory card whatsoever through my laptop. But unfortunately, the names of the folders and individual file names are still shown. Just can't open any of the individual files for viewing. By the way, there is an extra box to check in the Note 2 whether or not you want to also encrypt media files such as pictures and videos. I chose to also encrypt pictures and videos which take extra time for encrypting. Sure enough, my individual picture and video files don't open when I try to access the memory card through my laptop computer. However, if you have given a name for an individual picture file or video, the name does appear through my laptop computer, just can't open the individual file for viewing or playing.

What, you are not using an external memory card? I'm already down to 5.13 GB left of internal storage on my Note 2. At some point in time, I might have to delete 2 of my favorite racing games which are Asphalt 6 and 7, which take up a total of 3 GBs!! Freakin huge! Even my 64GB external memory card is already down to 31.89 GB left of free space. You must not have a lot of files to store, haha!

Casey

 

[Bobman]

I was hoping that it wasn't even possible to open the external memory card whatsoever through my laptop. But unfortunately, the names of the folders and individual file names are still shown. Just can't open any of the individual files for viewing. By the way, there is an extra box to check in the Note 2 whether or not you want to also encrypt media files such as pictures and videos. I chose to also encrypt pictures and videos which take extra time for encrypting. Sure enough, my individual picture and video files don't open when I try to access the memory card through my laptop computer. However, if you have given a name for an individual picture file or video, the name does appear through my laptop computer, just can't open the individual file for viewing or playing.

What, you are not using an external memory card? I'm already down to 5.13 GB left of internal storage on my Note 2. At some point in time, I might have to delete 2 of my favorite racing games which are Asphalt 6 and 7, which take up a total of 3 GBs!! Freakin huge! Even my 64GB external memory card is already down to 31.89 GB left of free space. You must not have a lot of files to store, haha!

Casey

I'm at 5.19 GB free on internal storage. I don't have a lot of games and I use Dropbox and Google Music extensively. So I only have to temporarily cache stuff. Most of my storage I am using is from pictures and videos I've taken and I can go delete those routinely since I'm sending them to Dropbox and Google+. I have a 32GB sd card on hand that is in my old Thunderbolt when I need it. I just decided not to put it in yet and see if this 16GB internal storage is really such an "issue".

 

[Gary02468]

I just want to confirm: with device encryption, you no longer have the option to set a delay (of up to an hour) before the password is needed in order to get past the lock screen?

I'm currently using a password without device encryption (on my AT&T Note 2, with Android 4.1.2 from the recent OTA update). I have it set to a one-hour delay, and I have a widget that can instantly lock the device when desired.

Normally, the device is securely in my pocket, and I access it often enough that I seldom need to enter the password. But if in a high-risk situation (say, leaving the phone in a public locker) or if I ever lose it, the password requirement can kick in.

I'd like to have the same setup along with device encryption. But if device encryption would require me to enter the password every time I turn the screen on, then that's more cumbersome than it's worth for me.

 

[bigguy_132]

Device encryption is only needed when the phone boots up. If for some reason the phone reboots you will need to enter the encryption password again. This password unencrypts the device so that it can be used. This is different from the lock screen setting and password.

The only time where the lock screen timeout would change is if you use a Corporate Sync account and your company requires you to have your phone lock sooner. They could force a setting change when you hook up your corporate sync account.

I just want to confirm: with device encryption, you no longer have the option to set a delay (of up to an hour) before the password is needed in order to get past the lock screen?

I'm currently using a password without device encryption (on my AT&T Note 2, with Android 4.1.2 from the recent OTA update). I have it set to a one-hour delay, and I have a widget that can instantly lock the device when desired.

Normally, the device is securely in my pocket, and I access it often enough that I seldom need to enter the password. But if in a high-risk situation (say, leaving the phone in a public locker) or if I ever lose it, the password requirement can kick in.

I'd like to have the same setup along with device encryption. But if device encryption would require me to enter the password every time I turn the screen on, then that's more cumbersome than it's worth for me.

 

[Bobman]

Device encryption is only needed when the phone boots up. If for some reason the phone reboots you will need to enter the encryption password again. This password unencrypts the device so that it can be used. This is different from the lock screen setting and password.

The only time where the lock screen timeout would change is if you use a Corporate Sync account and your company requires you to have your phone lock sooner. They could force a setting change when you hook up your corporate sync account.

No. Encryption also enforces the password on the lock screen. Looking at my settings it looks like the longest I can set the screen timeout for locking is 30 minutes. I have mine set to 5 seconds. It is a little more of a hassle with encryption since it forces you to use the more complex password with letters and numbers, but it is worth it to me.

Edit: and no I do not also have an exchange active sync account set up. As mentioned, this could also affect lock screen settings.