[Android Q&A, Help & Troubleshooting] spaboleo:
Quick Question regarding remote wipes and overall security of the phone's data in case of a loss/theft

Background story:

On New Year's Eve my good friend's iPhone 5S got stolen out of his pocket in a crowded club.

So I lent him my phone and we logged into iCloud using the Chrome Browser and triggered the wipe of the iPhone.

I offered him to call the credit card company and such if he had delicate data stored on the phone. But he refused...he trusts Apple's iCloud wipe routine and said he tested it at home and the phone was completely empty after that.

And he was surprisingly calm during the whole situation. :eek:

Okay he pays for insurance that covers a stolen phone, but I would have totally freaked out about my data...account logins, stored files and pictures, evernote notes, dropbox files etc.

My experience with the Android remote wipe:

Last evening I wanted to give it a try on my Android phone. So I pulled all the data that was on my phone and performed a nandroid-Backup of the system-files within TWRP and backed up my apps and data using TitaniumBackup.

And then I tried the Android Device Manager, which I had activated since it got released somewhen 2013, but never really tested more than the "localize" and "ring phone" functions.

Just yesterday I noticed the new "lock screen" function. Which is great, but I have always been using pattern locks anyway (triggered by Tasker, if my Wifi is not near). It's still nice to have and works like a charm (if the phone is connected to the internet).

So in addition I ordered my phone to get wiped. And it did what it said...it booted into Recovery and performed a factory reset / full-wipe.

But still all the data on the virtual sdcard was accessible after entering the SIM's pin code (I assume switching SIMs wouldn't change that) and setting up a new user profile. I know that it displays a warning that sdcards might not be wiped, during the process, but I thought this was referring to additional physical "microSD" storage. How wrong I was.

So all my pictures and stored files were fully accessible from the new user account.

If you store your unencrypted TitaniumBackup files on there the thief could easily restore them.

So encrypt them!

I was a bit shocked, to be honest.

And especially the fact that someone can access my phone's files without even knowing the lockscreen pattern/pin by simply booting into recovery bugs me.

Does encrypting the phone help in this situation?

Are there any drawbacks? I guess the speed and overall performance will decrease?

How can I protect the Recovery (I've got a HTC ONE, which is S-OFF'd and the bootloader unlocked via htcdev.com)?

Should I reflash the stock-recovery after flashing a CustomROM to at least make the thief require to reinstall the custom-recovery?

What other ways are there to protect the phone's data?

I don't let ADB turned on. (But this doesn't affect getting into recovery by rebooting.)

I don't keep nandroid/TitaniumBackup Backups on the phone. I pull them immediately onto a local computer after creation and delete them on the phone.

...what else?

To me booting the phone into recovery, hooking it up to any computer and using ADB to pull the sdcard's files is the most concerning security loop-hole. What am I saying...it's a shining and welcoming entrance with neon-signs all around it like a casino.

And exactly this is what taking my phone with me feels like, after the experience described above: GAMBLING...

Thanks in advance!

Every hint is very welcome :)

PS: If you want to try the wipe with the Android device manger yourself, be prepared that restoring the nandroid-Backup won't be possible! After a short while the phone will reboot itself and get wiped again.

The only way to restore the phone's former state was to restore the apps backups using TitaniumBackup in my case. Unfortunately some settings won't get restored, so I had to reenter all my mail accounts.

Just be prepared that it takes some time :)

PPS: I already posted this in the thread of the ROM I am currently using. Obviously no one didn't care over there ;) So I thought the question might be to broad and ROM-unrelated. Hence the repost here. :angel: