yashsingh1/xdaforums huggingface dataset:
[Honor 8 Questions & Answers] oifi:
[emoji23]

Best comment ever!

To be able to install twrp you have to unlock bootloader. Got it?

MOD EDIT

Please, respect other members...

TEKHD
[Honor 8 Questions & Answers] xor2000:
No need to be rude, especially if you are wrong. Unlocking the bootloader has nothing to do with encryption of the internal storage. If the internal storage is encrypted, you can not access the internal partitions without supplying the decryption password in TWRP.
[Honor 8 Questions & Answers] oifi:
Sorry for beeing rude.

Browse files is one thing, but are you able to view, edit or move them?
[Honor 8 Questions & Answers] adriansticoid:
I knew it. I don't know why Huawei messed with that kind of stuff.
[Honor 8 Questions & Answers] crzdmniac:
On my Honor 8 (L04) when I tried to switch my default storage to MicroSD it warned me that my phone was encrypted and to make sure the new storage location was secure before switching.
[Honor 8 Questions & Answers] xor2000:
It states the same on mine, though it is definitely not encrypted (must be a static default warning).
[Honor 8 Questions & Answers] crzdmniac:
I'm going to have to disagree with you. It appears to me that it's encrypted by default; I wouldn't be able to connect it to my Google Apps profile if it wasn't. See attachment.
[Honor 8 Questions & Answers] adriansticoid:
This is getting more confusing. So it REALLY is encrypted by default?
[Honor 8 Questions & Answers] oifi:
Yes! It's Android 6 so it has to be encrypted by default.
[Honor 8 Questions & Answers] adriansticoid:
All is clear now. Thanks!
[Honor 8 Questions & Answers] crzdmniac:
The same debate came up with the P9 and it was shown to be encrypted. That screenshot is from my personal phone added to a policy in Google Apps, and it clearly shows it's encrypted.
[Honor 8 Questions & Answers] vsriram92:
This also one of the reason due to which people are saying that Honor 7 won't get Nougat update.
[Honor 8 Questions & Answers] xor2000:
After putting some time into studying the internal storage encryption mechanism in Android 6 and on the Honor 8 (Firmware 120), I am pretty sure that it was limited by Huawei.

If you want to get a better understanding what "internal storage encryption" is, have a look at https://source.android.com/security/encryption/full-disk.html.

In short: Every Android 6 device should encrypt the internal storage (the "data" partition). It should do so automatically during the first start and protect the encryption key with a standard password that is well known ("default_password"). This will allow the device to boot without asking for a password at boot time. If the user later sets a lock screen unlock password, pin or gesture, then the encryption key will become protected by this password, pin or gesture. From then on, the user will have to enter the password/pin/gesture during every reboot.

What the Honor 8 seems to be missing is the ability to change the encryption key password, so it is always the publicly well known default password. The reason may be that this allows to skip the (ugly) default Android boot screen that requests the encryption key password/pin/gesture.

As long as your Honor 8's bootloader is locked, this is not much of a reason for concern, because there is no easy way to get to the raw data partition.

But if you unlock your bootloader (to install a new recovery ROM or to root your device), then the encryption together with the ability to change the encryption key password becomes the primary means to protect your data and is very important. On an Honor 8 with an unlocked bootloader, your data partition is readable without the need to enter a password for whoever has physical access to your phone.

I came to my conclusion because:

There is no Android 6 boot screen on the Honor 8 to ask for your pin/password/gesture.

On the Honor 8, the command "adb shell vdc cryptfs getpwtype" will always returns "213 0 default" (and not "password", "pin" or "gesture").

On the Honor 8, the command "adb shell vdc cryptfs changepw password <newpassword>", that should bring encryption and lockscreen password out of sync, has no effect (same with the "cryptfs password" app, that should do the same).

A 3rd party recovery, like TWRP, will not ask you for any password on the Honor 8 and still let you browse the "data" partition.

If you want to check my observations, be aware that by default "SuperSU" will disable Android's auto encryption of the "data" partition: Note that "/fstab.hi360" reads "encryptenable=...", not "forceencrypt=...". It does not help to change this back in the "/fstab.hi360", it must be done in the boot IMG-file. I have patched SuperSU so that it does not alter the boot IMG-file in this regard and checked that this worked.
[Honor 8 Questions & Answers] djhuzi:
Xor, so the patched version of Su let encrypt the phone?

Inviato dal mio FRD-L09 utilizzando Tapatalk
[Honor 8 Questions & Answers] xor2000:
The patch removes the deactivation of encryption otherwise introduced by SuperSU. But that just brings us back to the original limitation from Huawai: you again can not change the encryption key password on the Honor 8. So this does not help.
[Honor 8 Questions & Answers] :
Well this has definetly changed on the Nougat release? or TWRP fails to mount the /data partition for some reason :confused:
[Honor 8 Questions & Answers] xor2000:
That would be great, but: In fact, I did try out the Nougat beta today, but I had to flash it with TWRP and that did not fully work. Also, TWRP no longer was usable with the Nougat beta (TWRP did not even come up). Did TWRP work for you with the beta? How did you flash the beta?

Since the Nougat beta did not show the build-in stock Android encryption unlock screen after a change of the lock screen code and a reboot, I was under the impression nothing changed regarding the encryption issue.

However, after going back to the stable v131, the build-in stock Android encryption unlock screen did pop up to my surprise! I entered "default_password" and it confirmed that his was the correct password (another hint that the beta did not update the password). Then the boot process stated that my data partition is corrupt and will be wiped.

So, it seems that the build-in stock Android encryption unlock screen did kick in just because the beta firmware did damage the data partition, not because the beta improved regarding the encryption password.
[Honor 8 Questions & Answers] :
Yes I have a working twrp version lying on my phone but data partition is useless for now anyway [emoji14] I know it's encrypted just need to find a way to let twrp decrypt it.
[Honor 8 Questions & Answers] xor2000:
What version of TWRP are you using? I was using 3.0.2.0 from the official web site.

TWRP normally is able to handle non-default encryption passwords by prompting for a password.
[Honor 8 Questions & Answers] acehigh1971:
xor2000 you did an excellent explanation of how honor8 implements android 6 encryption.

I have one doubt: can you explain better how the device is protected if bootloader is locked? Why, with a locked bootloader, we cannot read raw data partition?

Because if we were able to read raw data we could decrypt it using "default_password" to decrypt the partition encryption key?
[Honor 8 Questions & Answers] xor2000:
Thanks, acehigh1971!

When you turn on the device, the firmware of the phone simply will not let anybody access the data partition through the USB port. It will only allow you to boot the installed Android (or the installed recovery firmware).

Once the bootloader has started Android, Android of course is allowed to read the data partition, but is protected by means of the usual Linux/Android security mechanisms.

You can swap out the firmware, but this requires you to unlock the bootloader, and this will in turn erase the data partition first.

This kind of security relies on the bootloader and firmware doing a good job of not letting anybody unauthorized through to the unprotected data partition. This is much weaker than a properly encrypted partition, but may be secure enough for most people - unless you unlock your bootloader of course, because then the data partition is effectively unprotected.
[Honor 8 Questions & Answers] acehigh1971:
Ok thank you.

So, for a locked device, the only way is to have access to flash chips. The data is encrypted, but can be decrypted as we said above.

Without access to flash chips we have to rely in bootloader not communicating with USB port. So, data security is in the hands of who did the bootloader. We rely and trust that honor/huawei did a good job in not putting backdoors into locked bootloader.

Please correct me if I'm wrong.

Thanks
[Honor 8 Questions & Answers] xor2000:
Yes, that sums it up pretty good I would say.

It is an issue for anybody with an unlocked bootloader though.
[Honor 8 Questions & Answers] weirdg:
According to this review:

http://www.digitaltrends.com/cell-phone-reviews/huawei-honor-8-review/#/1-4
[Honor 8 Questions & Answers] xor2000:
But your quote is regarding the fingerprint sensor, not the storage encryption.

However, the data storage is in fact encrypted, it is just useless because the password is the default one. It is like having a strong door in you house, but with the key left in the lock.
[Honor 8 Questions & Answers] Romiui:
storage encryption is not available with EMUI its now available with CM 14 .
[Honor 8 Questions & Answers] yalokiy:
honor 8 encryption fail

Just ordered the honor 8 a few days ago and this huawei's encryption cheating disappoints me a lot! I need proper encryption for my work and personal data, not a joke. :(

I wish we could bring this message as shocking news to every popular gadget website (xda blog, engadget, phonearena, gsmarena, androidauthority, arstechnica, anandtech etc.).

Make it a splinter in huawei's global image. Then, I guess, they'll fix it with the next update!
[Honor 8 Questions & Answers] :
And before it. It'll be exploited :)

Yeah rather contact huawei first then bomb them . If they don't take it seriously
[Honor 8 Questions & Answers] hachamacha:
delete
[Honor 8 Questions & Answers] hachamacha:
I did this in TE. It shows (if not clearly) that md-5 is mounted as /data and encrypted.

Darnit: Screenies aren't working for me at the moment:

Try this:

https://drive.google.com/open?id=0B7uZ3PSkONTGOGtmQ0l6c1lOYzg

That should get you to my online version of the screen-shot. You can also use setprop in TE to change {whatever} or change encryption.
[Honor 8 Questions & Answers] DarkGuyver:
Nope. Stock android does not encrypt your device's internal storage by default. However some device OEMs do incorporate internal storage encryption by default as an additional feature into their skinned version of android.
[Honor 8 Questions & Answers] yalokiy:
Wrote to huawei, google and all the news sites the same day. Nobody has ever replied.

I guess we have to prepare a proof of concept exploit...
[Honor 8 Questions & Answers] tzadkiel2:
In the TWRP, in english no other languages, to the look for the option Format Dates for Format internal storage when ask to write yes internal when finish storage recognized for PC, Mount USB (MTP) and internal storage decrypted and seems internal storage in PC, previous Backup to anticipated lossed information.

Same problem whit encrypted internal storage until I formatted it and solved problem.
[Honor 8 Questions & Answers] hachamacha:
I'm trying to use vdc from adb or te without being rooted but of course, it doesn't exist on the honor 8. Could someone rooted please upload a copy of it?

Thanks much.

I understand I won't be able to pop it into /system/xbin/ (or wherever) and use it but I was going to try it from /sdcard/ after changing permissions to execute.

It occurred to me that vdc might be part of some recent version of busybox or just a recently enabled part of busybox, so if that's the case (if you can type in $busybox vdc) then if you could please upload the "vdc enabled" busybox, that'd be great.
[Honor 8 Questions & Answers] Betacart:
If you make Factory Reset, then encryption will be visible in Settings>Security menu. If you set password, you will be asked for this password each time you boot your phone. But, after some days of using it, it disappears from menu and also PIN ask at start will be disabled. I totally not understand this behaviour, as it is same on Honor 7, which I had before. So, if you do Factory Reset, you will have that option, but only for few days/runs :( I did not find any dependency, what can cause this feature loosing...
[Honor 8 Questions & Answers] hachamacha:
The info contained in post #45 of this thread seems on the button in terms of presenting the problem. What you say is interesting and many phones that come with Android 6 and above are shipped encrypted with "default_password" as the password. It is what TWRP checks for upon entry and only present you with a password prompt if "default_password" is not the password (I was just looking at the code).

One thing I found to be true on an OP3t phone I had for 2 weeks was this: It also came encrypted with default password. It was "only" changed if I entered another "password", not a PIN and not a pattern. Only Password gave the encryption daemon a kick to re-write it's initial sector and change the password. Once it had changed it, TWRP would ask you for that password, and only that password would get you safely in and show you decrypted data. (/userdata).

The way you're putting it makes it sound as if it's just an Honor 8 emui bug which is totally possible. I'd like to get another look at the "vdc encryptfs" tools but aren't sure I want to keep the phone so also not sure I want to root it yet. I don't want to do a factory reset unless I'm going to unlock bootloader & root, but I kind of wish I could test your point.
[Honor 8 Questions & Answers] Betacart:
Great, thank you. I am also wondering, if you encounter same behaviour. One more thing - I am using Mi Band 2 to unlock screen, and as unlock password, I set same password as for encryption.
[Honor 8 Questions & Answers] :
Yeah but it won't encypt it right

Well at least not with modified boot ðŸ˜‹
[Honor 8 Questions & Answers] Betacart:
Factory Reset will enable menu option to decrypt in Security. Then, you enter PIN and encrypting process will start (in my case, it takes around 30 minutes). But, as I said, after some time, this menu option disappeared from Security menu as well as asking for PIN when booting phone.
[Honor 8 Questions & Answers] :
Well that's probably because you're encrypted you could look with diskinfo what it tells you
[Honor 8 Questions & Answers] Betacart:
Yes, I checked by Disk Info and yes, it is encrypted. But, why option disappear from Security menu....
[Honor 8 Questions & Answers] :
Because it isn't there by default either if you're encrypted
[Honor 8 Questions & Answers] Betacart:
OK, thanks, I don't know that, because my previous phones has always option to revert it back to unencrypted state.
[Honor 8 Questions & Answers] hachamacha:
That seems like a GUI screwup for settings. I agree that the option to disable encryption should remain. Also the changing of the password to be different than the PIN or unlock password or pattern should also be there. Entering a password should re-write the encryption header to match at the least so that booting to TWRP (which at first checks the password and if it's not the "default_password" , then it asks you each time you enter TWRP) asks you for it.

It's just a bug. Can we report them somewhere. Their forums seem useless and not monitored by Honor employees.,
[Honor 8 Questions & Answers] leo06:
I checked with disk info https://play.google.com/store/apps/details?id=me.kuder.diskinfo the data partition and it's encrypted, also the filesystem is f2fs for data, maybe that's why is so fast opening apps
[Honor 8 Questions & Answers] :
Yeah but we're you force encrypted then?

We could change the password check to blahthispasswordisnotdefault :)

Yeah I use ext4 no issues with opening apps not too slow either
[Honor 8 Questions & Answers] djhuzi:
No news? With new Nougat's update i don't make root if there isn't possibility for encrypt with password the phone..

Inviato dal mio FRD-L09 utilizzando Tapatalk
[Honor 8 Questions & Answers] adriansticoid:
Patience is a virtue.
[Honor 8 Questions & Answers] skeeterfood:
On EMUI 5, or at least on the US FRD-L04C567B360 firmware, the setting to encrypt the phone's storage is hidden and it doesn't seem to be encrypted by default! Trying to add my work Google account and the Device Policy app claims it's not encrypted. I'm going to try encrypting it tonight. I already set up a Nova Launcher Activities widget to call .Settings$CryptKeeperSettingsActivity, but I have to charge my phone back over 80% first.
[Honor 8 Questions & Answers] Saythis:
Weird, diskinfo showed mine as encrypted running FRD-L04C567B360, but there was no option to decrypt it in settings. According to the TWRP threads for Nougat, it's why /data can't be mounted in TWRP and why it requires a reformat to get rid of the /data encryption.
[Honor 8 Questions & Answers] skeeterfood:
Well that didn't work anyway. Showed a green Android then rebooted. Google Device Policy still says device encryption required.
[Honor 8 Questions & Answers] hachamacha:
The thing (re: encrypt) I find confusing about emui 5 / so-called Nougat encryption, is that it appears to have been snipped out of emui 5's settings. I don't mean the "encrypt disk" option because I don't really care about that one (and it works anyway via pin/pwd), but the other one that showed up with Nougat called FBE.

On any other Nougat version I've seen, there is a "developer" option in settings called "convert to file encryption". The converts from "standing encryption or full disk encryption" to "file based encryption". FBE will be the default on 7.1 forward (well, until something better is thought of).

If you do a settings and search for Encrypt or "convert" then it shows you the link "{} convert to file encryption" and claims it is under developer settings. If you click on it under the search results, then it takes you to developer settings, and it is not there on mine anyway (emui 5 b360). Is there some chance it could be elsewhere or is this yet another cool feature that's been shut off by emui?

For a real explanation just look at FBE in Nougat and pick your favorite. It makes much more sense to me than full disk encryption and having to enter a PIN / PWD on the reboot or in TWRP. (not that anything works in TWRP when it comes to encryption).
[Honor 8 Questions & Answers] :
That's no mate 9 only
[Honor 8 Questions & Answers] hachamacha:
I've no idea about Mate 9's. It's what happens to my Honor 8 with emui 5. It's standard Nougat on phones other than Honor.
[Honor 8 Questions & Answers] goorek:
When you go into developer settings on Android 7.0, fast system updates are checked. Isn't it only available with file based encryption?
[Honor 8 Questions & Answers] hachamacha:
Fast system updates aren't visible on my developer options on emui 5. Did you mean emui or pure Android 7? With FBE , it was visible if I searched the settings from the first settings page. Besides, you can easily see evidence that "standing encryption" is used by default from adb shell on emui 5. Also my phone asks for the encryption password (something FBE doesn't) during boot.

Seems like there are a lot of developer options that're either on-the-fly based or just not enabled on emui. FBE seems to be one of them. A lot of the encryption stuff doesn't make much sense. I've already replied about some looking into how to prove encryption status and show it using the command line, but can't recall where I replied that. It's in the forum is all I recall. Typically the "vds cryptfs" commands would allow setting a non-pin/pwd (a different one anyway than what you type in) as the encryption key for the full-disk encryption. Lots of things are missing.

Thanks.
[Honor 8 Questions & Answers] goorek:
I meant 'automatic system updates'

Just saw that it means smth completely different
[Honor 8 Questions & Answers] StratOS_HTC:
Encrypt

Ok, for a start ...

Don't have a lot of lock for now ...

But together we could manage it ...

The initrd's :

fstab's for ext4 & s2fs :

for /data :

/dev/block/bootdevice/by-name/userdata /data ext4 rw,nosuid,nodev,noatime,user_xattr,acl,barrier=1,data=ordered,noauto_da_alloc,mblk_io_submit,discard wait,encryptable=footer,check

/dev/block/bootdevice/by-name/userdata /data f2fs nosuid,nodev,noatime,discard,inline_data,inline_xattr wait,encryptable=footer,check

So the first thing the footer DATA is encrypted and that's why you cannot easy make a full backup of /userdata/ ...

Second the init.rc :

on nonencrypted
exec - root -- /system/bin/update_verifier nonencrypted
class_start main
class_start late_start

on property:vold.decrypt=trigger_reset_main
class_reset main

on property:vold.decrypt=trigger_load_persist_props
load_persist_props
start logd
start logd-reinit

on property:vold.decrypt=trigger_post_fs_data
trigger post-fs-data

on property:vold.decrypt=trigger_restart_min_framework
exec - root -- /system/bin/update_verifier trigger_restart_min_framework
class_start main

on property:vold.decrypt=trigger_restart_framework
exec - root -- /system/bin/update_verifier trigger_restart_framework
class_start main
class_start late_start

on property:vold.decrypt=trigger_shutdown_framework
class_reset late_start
class_reset main

service defaultcrypto /system/bin/vdc --wait cryptfs mountdefaultencrypted
disabled
oneshot

service encrypt /system/bin/vdc --wait cryptfs enablecrypto inplace default noui
disabled
oneshot

Don't have a lot of luck building a rebuiled boot that works with changes.

Manually format FS don't work also.

Looking back for a joined work on it ...
[Honor 8 Questions & Answers] DYNAMIC+:
is there any update about this issue?

there is no solution to have (real...) encryption on honor8?
[Honor 8 Questions & Answers] JackSlaterIV:
Hi guys, I read the entire thread and I found it very interesting.

I'm starting to think that this "default_password" that you see after having unlocked the bootloader could be different from the one that is used when your phone is still locked.

So maybe when the phone is brand new, with its bootloader still locked, the encryption password that it uses is a random generated one. After you unlock the bootloader, the device begins to use that "default_password" for some reason.

So the question is: how can you verify what the ecryption password is, on a phone that was never unlocked? Or at least, is there a way to verify that the device doesn't use the "default_password", without having unlocked its bootloader?

P.S.

I can do some test for you on a device (Honor 6x) which is untouched brand new.
[Honor 8 Questions & Answers] EdRoxter:
[...Edit: I just discovered that everything I described here has already been said and tested with a negative result...]
[Galaxy Note 4 Q&A, Help & Troubleshooting] proking2144:
Ive been having issues flashing stock roms for my samsung note 4 SM-N910F, ive been downloading 5.0.1 lollipop (default firmware that was already installed).

but everytime i try to flash the rom i get an error on odin saying AUTH failed. am i flashing the correct firmware?

I tried using samfirm but i cant find the region code for mine since its an international model.
[Galaxy Note 4 Q&A, Help & Troubleshooting] Shane_Picardo:
Here's the link. You can use any one of these, it doesn't matter as long as your model number is SM-N910F

http://www.sammobile.com/firmwares/database/SM-N910F/
[T-Mobile Samsung Galaxy S7 Edge Questions & Answer] pitbullmommy45245:
I have always been confused by the battery life apps. I have a rooted device with Xposed installed. I wanted to install a battery saver and ram manager. What's the best battery saver app and what settings should I use. What's a good ram and cache manager app?
[T-Mobile Samsung Galaxy S7 Edge Questions & Answer] ohmyduck:
Nothing can help unless samsung wants to help themselves