Related
Hey Guys,
When I got my OP3 I unlocked the bootloader right away and installed FreedomOS to get rid of the bloatware. As this is my first device, which comes with a locked bootloader and decryption, I have some questions about this topic. I was wondering that the encryption does not make any sense when you unlock your bootloader, because if somebody steals your phone, he can just enter twrp and access all your data. Then I flashed CM and after that TWRP was asking me to set a pin or pattern to lock my phone. Now I've to unlock my phone every time I want to enter the recovery or boot the system with a pattern, which is great, because now the encryption is not worthless anymore. Now I'm asking myself if this feature is somehow integrated into CM or was it just random that I found this feature? Is there any way to get this also with OOS installed? What things do I have to note to not accidentally make my phone unencryptable with the pattern? Is this even possible, maybe by flashing a new recovery or so?
Thanks in advance
Gerrit507 said:
Hey Guys,
When I got my OP3 I unlocked the bootloader right away and installed FreedomOS to get rid of the bloatware. As this is my first device, which comes with a locked bootloader and decryption, I have some questions about this topic. I was wondering that the encryption does not make any sense when you unlock your bootloader, because if somebody steals your phone, he can just enter twrp and access all your data. Then I flashed CM and after that TWRP was asking me to set a pin or pattern to lock my phone. Now I've to unlock my phone every time I want to enter the recovery or boot the system with a pattern, which is great, because now the encryption is not worthless anymore. Now I'm asking myself if this feature is somehow integrated into CM or was it just random that I found this feature? Is there any way to get this also with OOS installed? What things do I have to note to not accidentally make my phone unencryptable with the pattern? Is this even possible, maybe by flashing a new recovery or so?
Thanks in advance
Click to expand...
Click to collapse
If your phone is encrypted, TWRP has to prompt you to decrypt the /data partition before it can be mounted. This isn't a CM feature, it should act like this with any ROM if phone encryption is enabled. I've flashed most every rom and version of twrp in this forum and they all seem to work fine with the encryption enabled. I have not flashed multiboot yet as that requires your phone to be completely unencrypted. Not sure if that answers your question.
If security is your concern though, I would recommend switching to a passphrase instead of pattern for encryption unless your pattern is very long and complex. I recommend a passphrase of at least 16 characters.
kennonk said:
If your phone is encrypted, TWRP has to prompt you to decrypt the /data partition before it can be mounted. This isn't a CM feature, it should act like this with any ROM if phone encryption is enabled. I've flashed most every rom and version of twrp in this forum and they all seem to work fine with the encryption enabled. I have not flashed multiboot yet as that requires your phone to be completely unencrypted. Not sure if that answers your question.
If security is your concern though, I would recommend switching to a passphrase instead of pattern for encryption unless your pattern is very long and complex. I recommend a passphrase of at least 16 characters.
Click to expand...
Click to collapse
Ok I see, than I was getting something wrong there, thank you. The thing is FreedomOS stated that the phone is encrypted but I was never asked for the pattern by TWRP...
Gerrit507 said:
Ok I see, than I was getting something wrong there, thank you. The thing is FreedomOS stated that the phone is encrypted but I was never asked for the pattern by TWRP...
Click to expand...
Click to collapse
When you first booted up your stock phone and went through setup it asks if you want to secure the phone using pin/pattern/passphrase. I think that is where it is created then that key is written somewhere, not on the data or system partitions because is persists between wipes, and that is where TWRP and all future roms are authenticating you.
kennonk said:
When you first booted up your stock phone and went through setup it asks if you want to secure the phone using pin/pattern/passphrase. I think that is where it is created then that key is written somewhere, not on the data or system partitions because is persists between wipes, and that is where TWRP and all future roms are authenticating you.
Click to expand...
Click to collapse
Ok, I can not remember this... Then I guess the phone just stated it was encrypted and wasn't... And how can I change this pattern or unencrypt the phone?
Gerrit507 said:
Ok, I can not remember this... Then I guess the phone just stated it was encrypted and wasn't... And how can I change this pattern or unencrypt the phone?
Click to expand...
Click to collapse
Here is how to decrypt without losing data. http://forum.xda-developers.com/oneplus-3/how-to/unencrypt-oxygenos-loosing-data-t3412228
There is another article I think I saw it on the OnePlus forums about how to decrypt and wipe which will let you change the passphrase I think.
Basically if you decrypt, then flash Oxygen or Hydrogen without SuperSU it will force you to re-encrypt. At least that is my understanding as I haven't decrypted yet.
Good luck
kennonk said:
Here is how to decrypt without losing data. http://forum.xda-developers.com/oneplus-3/how-to/unencrypt-oxygenos-loosing-data-t3412228
There is another article I think I saw it on the OnePlus forums about how to decrypt and wipe which will let you change the passphrase I think.
Basically if you decrypt, then flash Oxygen or Hydrogen without SuperSU it will force you to re-encrypt. At least that is my understanding as I haven't decrypted yet.
Good luck
Click to expand...
Click to collapse
As far as I understood it, it's all about wiping userdata, which I did before flashing Freedom OS. This might explain why I had no encryption... Still strange that it did not prompt me again to set a new one...
edit: FreedomOS has supersu, but systemless... I also flashed supersu right after CM which is even more strange...
Gerrit507 said:
As far as I understood it, it's all about wiping userdata, which I did before flashing Freedom OS. This might explain why I had no encryption... Still strange that it did not prompt me again to set a new one...
Click to expand...
Click to collapse
Yeah I have wiped userdata and system and clean reflashed like 20-30 times in the last few weeks and I've never been prompted to recreate the initial passphrase I set for encryption.
kennonk said:
Yeah I have wiped userdata and system and clean reflashed like 20-30 times in the last few weeks and I've never been prompted to recreate the initial passphrase I set for encryption.
Click to expand...
Click to collapse
But I never had to decrypt in TWRP... It's mysterious As far as I understand the guide he just wipes userdata and the encryption is gone... Is there somebody who knows for sure where the key is located actually?
edit: Seems like the encryption key is coupled to your password
When a user elects to change or remove their password in settings, the UI sends the command cryptfs changepw to vold, and vold re-encrypts the disk master key with the new password.
Click to expand...
Click to collapse
https://source.android.com/security/encryption/
I can confirm that. I changed my pattern and unlocked the phone with it at booting.
If I remove my password it still says "encrypted" in security but I don't have to enter any pattern at boot.
Mine says "Encrypted" under Settings > Security & Fingerprint > Encryption but I can boot into TWRP and browse the entire file system without ever entering my pin code.
dcdruck1117 said:
Mine says "Encrypted" under Settings > Security & Fingerprint > Encryption but I can boot into TWRP and browse the entire file system without ever entering my pin code.
Click to expand...
Click to collapse
Sounds like you have the same issue like I had. It seems to me like an issue in OOS.
This is awesome. I thought rooting and unlocking the bootloader to install custom ROMs would need the phone to be decrypted -- great, great news!
So without knowing the passphrase a possible attacker can't get to the data even when the bootloader is unlocked and OS rooted?
kanttii said:
This is awesome. I thought rooting and unlocking the bootloader to install custom ROMs would need the phone to be decrypted -- great, great news!
So without knowing the passphrase a possible attacker can't get to the data even when the bootloader is unlocked and OS rooted?
Click to expand...
Click to collapse
Yes, all your data is being decrypted after your enter the passphrase.
Does anyone have any idea how I can encrypt my phone if it already says Settings > Security & fingerprint > Encryption > Encrypt phone = "Encrypted"? It's clearly not actually encrypted because I do not have to enter any pin to boot or read data in TWRP.
dcdruck1117 said:
Does anyone have any idea how I can encrypt my phone if it already says Settings > Security & fingerprint > Encryption > Encrypt phone = "Encrypted"? It's clearly not actually encrypted because I do not have to enter any pin to boot or read data in TWRP.
Click to expand...
Click to collapse
Go to lock screen settings and set it up again. You will be prompted if you want to enter pin every reboot.
proag said:
Go to lock screen settings and set it up again. You will be prompted if you want to enter pin every reboot.
Click to expand...
Click to collapse
Hey, thanks! The "require PIN to start device" screen doesn't make any mention of encryption, so I was under the impression that it was far more basic and wasn't at all related to encryption. I tried it though and now TWRP does ask me to decrypt my data partition, so it does work. Thanks for the assist!
been following this thread and i had a quick questions - so it looks like if you unlock BL and run a custom ROM, you can still have the security of encryption, but does this ONLY apply to the USERDATA partition?
for example, could someone launch TWRP recovery on your phone and flash something into the SYSTEM partition without ever touching your userdata partition (ie, a keylogger or malware)?
It seems to me that only the data partition is encrypted, but someone correct me if I'm wrong. I looked at the Android full disk encryption page and I only see mentions of the data partition.
dcdruck1117 said:
It seems to me that only the data partition is encrypted, but someone correct me if I'm wrong. I looked at the Android full disk encryption page and I only see mentions of the data partition.
Click to expand...
Click to collapse
so system is never encrypted? i guess at that point the stock recovery stops you from flashing malware but \TWRP wont
dcdruck1117 said:
It seems to me that only the data partition is encrypted, but someone correct me if I'm wrong. I looked at the Android full disk encryption page and I only see mentions of the data partition.
Click to expand...
Click to collapse
Your internal storage is mounted into your data partition actually. I think this means it's also encrypted.
2x4 said:
so system is never encrypted? i guess at that point the stock recovery stops you from flashing malware but \TWRP wont
Click to expand...
Click to collapse
I see no reason behind encrypting system, it's used read-only anyway as long as you don't flash something to it.
edit: Ah I see now what you mean. But if you have stock recovery you can also simply flash twrp over it or flash something to system via adb... I don't know if it would even be possible technically to encrypt system. Anyway I think the only solution would be to lock the bootloader I think. I don't know what actually happens if you lock your bootloader again while on twrp and custom rom, might brick your device
Since this is my first phone with encryption and fingerprint reader after my Nexus 5, I am a tad bit confused about the whole topic. So here are a few questions about it:
I currently have ressurection remix installed and in security settings it says my phone would be encrypted. If I click on this, nothing happens, so I guess I cannot change the encrypted state?
When I boot into TWRP, I am asked to decrypt data with my passkey, which I set up while OOS was still installed. So does this persist through system and data wipes?
If so, how can I actually change this passphrase? Might be kind of similar to question 1.
What would be the right way to relock the bootloader without bricking the phone if this passphrase is not stored in data or system partition?
With every factory reset and flashing a new rom, does everything get encrypted with the passphrase I have setup before?
So I kind of like the fact encryption is turned on automatically by Nextbit (and I did figure out how to get out of my encryption loop)
And I have tried to encrypt the disk with
-Pacman ROM
-Reserrection ROM
-Paranoid Android
and all of them bootloop and never actuall boot up once you press "encrypt".... so is it impossible to encrypt once you have an unlocked bootloader and recovery installed? I get its detrimental to the whole process of flashing incessantly but still
Grrrrrrr
Can sum1 confirm
tlxxxsracer said:
If you unlock the bootloader,that alone won't cause encryption issues. You have to flash a specific boot.img or zip that will disable encryption.
Don't unencrypt and should be fine.
Not sure why you'd want to encrypt if your BL is unlocked. Encryption only hurts performance
Click to expand...
Click to collapse
thanks for the reply
I wanted to encrypt my current ROM to just get the extra protection from theft or lost device.
I really like the current ROM im using and dont need to flash anymore currentlty, so i would be fine locking it down with encryption
But i cant get ANY of the ROMS to encrypt like they normally do say compared to the G3
So there is a solution to this. Basically, when you encrypt the file system on one rom, even when you wipe the data certain things are still tied to the old file system. That's why when you go to encrypt the encryption fails, because the remnant stuff from the other rom is in the way. The solution is to completely reformat the data partition (using TWRP, select format data, or change the data file system to F2FS and then back to ext4.). This will clear the conflicts causing encryption to bootloop. However, this process will need to be repeated every single time you switch roms (updating a rom is fine).
I believe Cyanogenmod supports encryption, though I have never tried it.
yanowman said:
So I kind of like the fact encryption is turned on automatically by Nextbit (and I did figure out how to get out of my encryption loop)
And I have tried to encrypt the disk with
-Pacman ROM
-Reserrection ROM
-Paranoid Android
and all of them bootloop and never actuall boot up once you press "encrypt".... so is it impossible to encrypt once you have an unlocked bootloader and recovery installed? I get its detrimental to the whole process of flashing incessantly but still
Click to expand...
Click to collapse
If you flashed the custom boot image, you CANNOT re encrypt your phone. Won't work.
Hello all!
So I've been rooting and installing custom ROMs on my Android phones since getting started on my Galaxy S2 back in the day, and as it stands I've never encountered such an annoying roadblock as I've been forced to deal with over the past few days.
I just got a new HTC 10, and quickly went ahead and rooted my phone to get a custom ROM on there. The ROM seemed to boot fine, but the home button wasn't working and I had forgotten to download and install GApps. The other problem was, upon flashing the new LineageOS, TWRP would not recognize any files whatsoever on my device--including the backup I had made. So, I went ahead and flashed the latest RUU and returned to stock. After realizing the RUU is Nougat firmware, I got the latest TWRP and went ahead to try and reinstall Lineage again.
This time, however, the phone decided to stop on a screen asking for a password before it fully boots. I've tried this with every ROM I've installed and every time it will ask for a password. Boot into Recovery, and it will ask for a password there and have all my files hidden, keeping me from doing anything short of a re-flashing my RUU to return to stock. I know these ROMs evidently encrypt your phone during first boot, but I'm at a loss for info on what I'm apparently doing wrong to cause this issue.
Is this an Android N issue? On M, I was able to boot into Lineage, though TWRP still had the file issue. Anyways, whatever help would be fully appreciated. Since I'm a new user I wasn't able to inquire directly on the LineageOS thread, and so deferred to Q&A.
EDIT:
I've solved the issue. After re-flashing the RUU, flashing TWRP, and re-rooting over and over, I figured out what seemed to be going on.
In case anyone else has the same problem as me, here was my solution:
Starting from stock, I went ahead and flashed my phone with the latest TWRP compatible with N (3.0.3.0 at this current time). Afterwards I flashed LineageOS and GApps. As usual, upon reboot, the phone needed a password to get in. So, I rebooted to Recovery, which also required a password. I hit cancel, wiped the phone with a factory reset, formatted all data, and restarted. This did the trick, and I've been running LineageOS 7.1 with no problems whatsoever!
Which version of TWRP are you using at the moment. If you're on N firmware I'd recommend to use 3.0.3-0, that is to be found on the download tab of the TWRP thread.
Sent from my htc_pmeuhl using XDA Labs
dreDREb13 said:
Hello all!
So I've been rooting and installing custom ROMs on my Android phones since getting started on my Galaxy S2 back in the day, and as it stands I've never encountered such an annoying roadblock as I've been forced to deal with over the past few days.
I just got a new HTC 10, and quickly went ahead and rooted my phone to get a custom ROM on there. The ROM seemed to boot fine, but the home button wasn't working and I had forgotten to download and install GApps. The other problem was, upon flashing the new LineageOS, TWRP would not recognize any files whatsoever on my device--including the backup I had made. So, I went ahead and flashed the latest RUU and returned to stock. After realizing the RUU is Nougat firmware, I got the latest TWRP and went ahead to try and reinstall Lineage again.
This time, however, the phone decided to stop on a screen asking for a password before it fully boots. I've tried this with every ROM I've installed and every time it will ask for a password. Boot into Recovery, and it will ask for a password there and have all my files hidden, keeping me from doing anything short of a re-flashing my RUU to return to stock. I know these ROMs evidently encrypt your phone during first boot, but I'm at a loss for info on what I'm apparently doing wrong to cause this issue.
Is this an Android N issue? On M, I was able to boot into Lineage, though TWRP still had the file issue. Anyways, whatever help would be fully appreciated. Since I'm a new user I wasn't able to inquire directly on the LineageOS thread, and so deferred to Q&A.
Click to expand...
Click to collapse
Installing cm will encrypt your device, was you encrypted previously? Then you would have created a password to access your device.
In my case, I formatted data and then flashed my sense rom (venom) I chose not to encrypt, cm doesn't give this option when you flash it so you have no choice at the time. So if you don't have the password and the device has been encrypted you'd have to format data, don't jump into that just yet though.
Unless someone else knows a way around that, personally I couldn't. However I did have a rom installed so I could boot the rom and back up my data once in the OS. Then format (not wipe) and then reinstall the rom.
Sounds confusing, to be sure we need more info from you.
Do you have an operating system at the moment? If you do then back up your data so that's safe.
Do you know the password to decrypt your phone??
5m4r7ph0n36uru said:
Which version of TWRP are you using at the moment. If you're on N firmware I'd recommend to use 3.0.3-0, that is to be found on the download tab of the TWRP thread.
Sent from my htc_pmeuhl using XDA Labs
Click to expand...
Click to collapse
I'm running 3.0.3.0. I had a problem after re-flashing my RUU where TWRP wouldn't boot, but I quickly realized this was due to using an M compatible TWRP with the new firmware.
dladz said:
Installing cm will encrypt your device, was you encrypted previously? Then you would have created a password to access your device.
In my case, I formatted data and then flashed my sense rom (venom) I chose not to encrypt, cm doesn't give this option when you flash it so you have no choice at the time. So if you don't have the password and the device has been encrypted you'd have to format data, don't jump into that just yet though.
Unless someone else knows a way around that, personally I couldn't. However I did have a rom installed so I could boot the rom and back up my data once in the OS. Then format (not wipe) and then reinstall the rom.
Sounds confusing, to be sure we need more info from you.
Do you have an operating system at the moment? If you do then back up your data so that's safe.
Do you know the password to decrypt your phone??
Click to expand...
Click to collapse
Turns out formatting the data was the solution. Thankfully this phone is brand new, so there was no data to lose.
As for why Cyanogen and Lineage automatically encrypt without giving some sort of default password, I have no idea...
Thanks for the help, though!
dreDREb13 said:
Turns out formatting the data was the solution. Thankfully this phone is brand new, so there was no data to lose.
As for why Cyanogen and Lineage automatically encrypt without giving some sort of default password, I have no idea...
Thanks for the help, though!
Click to expand...
Click to collapse
Could have thought of that myself. Encryption used by Cyanogen/Lineage is different to HTCs encryption used on Sense based ROMs. Thanks for your feedback.
Sent from my htc_pmeuhl using XDA Labs
dreDREb13 said:
I'm running 3.0.3.0. I had a problem after re-flashing my RUU where TWRP wouldn't boot, but I quickly realized this was due to using an M compatible TWRP with the new firmware.
Turns out formatting the data was the solution. Thankfully this phone is brand new, so there was no data to lose.
As for why Cyanogen and Lineage automatically encrypt without giving some sort of default password, I have no idea...
Thanks for the help, though!
Click to expand...
Click to collapse
There is no password and I've had it out in the cm thread, apparently it's common knowledge, which we've both found out its not, there is no password either so you did what was required.
Also, click thanks instead of saying mate [emoji6]
Glad you're back up and running.
thanks had same issue when installing Lineage 14.1 nightly on my HTC 10 today, which already had twrp on it and the stock rom - your solution worked.
i.e.
turn off device
hold volume down while pressing power for few seconds
choose reboot to bootloader from menu
choose boot to recovery mode
hit cancel when prompted for password
choose wipe from twrp, use default options
reboot
no more password prompt.
Hi everyone,
I would like to know if I can use device encryption in Lineage OS 15.1.
I currently have TWRP 3.2.2-0 installed on my Samsung Galaxy S5 Plus (kccat6).
Can TWRP 3.2.2-0 decrypt Lineage OS ?
By the past, I have seen many posts on forum, telling that they had trouble with the encryption or when they wanted to update LineageOS (which is currently in Nightly phase... so where updates can be important).
Thank you in advance for your answers !
Yes you can, but you have to update your TWRP to the latest version (3.2.3-0), they fixed the automatic installing of OTA zips on encrypted devices
Thanks lucaslbbh. So I made it. I was astonished to see that the process lasted only 9 min... Unfortunately, my phone was unable to start after that (bootloop).
I came back to TWRP, entered my password and restored my Nandroid backup.
Surprinsgly, it kept the encryption : I have to enter my PIN for each startup, and when I want to enter in TWRP. In the security menu, it's said it's encrypted.
Is it possible ?
oldbear3 said:
Thanks lucaslbbh. So I made it. I was astonished to see that the process lasted only 9 min... Unfortunately, my phone was unable to start after that (bootloop).
I came back to TWRP, entered my password and restored my Nandroid backup.
Surprinsgly, it kept the encryption : I have to enter my PIN for each startup, and when I want to enter in TWRP. In the security menu, it's said it's encrypted.
Is it possible ?
Click to expand...
Click to collapse
https://forum.xda-developers.com/galaxy-note-8/how-to/guide-how-to-root-device-encryption-t3742493
This guide was only tested with Nougat but it says the ROM has to be unrooted when encrypting /data. Maybe that's your prob?