Physical Phone Security

Our mobile phones have become the center of our digital lives. We carry them with us everywhere we go. Let’s learn how to keep them physically secure.

Physical Device Security

We use smartphones for everything. I prefer using a computer, but if I had to, I could do just about everything online that I needed to do just using my phone. That also means that anyone who can steal my phone could access a lot of personal data and potentially drain my bank accounts. (Stealing phones to resell them used to be a thriving industry, but protections built into phones today have thankfully made reselling them very difficult.)

But we don’t need to worry only about thieves taking our phones. In today’s world, we also have to consider the case of legal device confiscation – for example, by a law enforcement officer or border control agent. In this case, you would have to assume that your device could be subjected to sophisticated data extraction tools.

To protect you against these threats, both Apple and Google have added a lot of physical phone security features in recent years – ones that you may not be aware of, or perhaps have run across but were reluctant to enable because you weren’t sure what they actually did. Let’s walk through some of the top security features you might want to enable on your iOS or Android devices.

NOTE: Many of these security features overlap. I’ll provide links at the end of the article that will cover all the suggestions I discuss here. Also, many of the these security features are relatively new, requiring the latest or near-latest version of iOS and Android.

Device Locking & Authentication

All smartphones have the capability to require a PIN code to unlock the device. You should not only turn this on, you should use a code that’s longer than 4 digits (the usual default). I would use a minimum of 6 digits. Using characters as well as numbers (like a password) is even better.

Biometric unlocking using your fingerprint or face scan is convenient and secure from a purely technical perspective. However, you need to consider your threat model. For example, law enforcement in many jurisdictions can legally compel you to unlock your phone using biometrics, but cannot compel you to divulge a PIN code. These laws and precedents are always evolving, so you should research this for your locale if it’s a concern. On the other hand, if you’re in a public place where someone could observe and record the digits you enter (including via a security camera), then unlocking your device using biometrics would be more secure.

Many apps that access sensitive information or online accounts have the capability to require your PIN or biometric unlock to use them. You should definitely enable this on your financial apps, but perhaps also on messaging or other apps that might have access to sensitive information.

USB Data Protection

If someone has physical access to your phone, it opens the device up to attack via the hardware inputs including the touch screen, Bluetooth, WiFi, NFC and the USB port. (Note that this potentially even includes public USB charging ports.) There are special ‘forensics’ devices that are built for this purpose such as GrayKey and Cellebrite. It’s been a real cat-and-mouse game between the hostile data extraction companies and the device makers, but generally speaking, the most secure devices are the most recent ones running the latest OS version.

If you have a PIN code set, all the data on your device will be encrypted on the drive. However, the decryption keys can be in memory once the device has been unlocked for the first time after a reboot. This is known as After First Unlock (AFU) state – as opposed to Before First Unlock (BFU) state. So, if you’re ever worried about your phone being taken, you should reboot it and leave it locked because BFU state is more secure than AFU.

Apple and Google have added some welcome security features in recent years that can really help you here. For example, if your iPhone is idle for an hour (after being unlocked) or if it’s been freshly rebooted (BFU state), the USB port is restricted, requiring a PIN code to allow data connections. On Android, the USB port’s data access is blocked whenever the phone is locked.

Automatic Stolen Device Protection

In recent versions of iOS (17.3) and Android (16), Apple and Google have added other anti-theft protections that will automatically put your phone in a locked down state in situations that appear suspiciously like a device theft. Apple has a Stolen Device Protection feature that will prevent certain important actions from being available when not in a ‘familiar location’ like home or work. Android’s Advanced Protection mode includes Theft Detection Lock and Offline Device Lock, which purport to detect ‘snatch and grab’ thefts (using the built-in accelerometer) and suddenly going offline (like being stuffed into a Faraday bag). When triggered, the phone requires a PIN to unlock and effectively goes into a BFU mode.

But wait, there’s more. If your phone has been idle for 3 days, it will automatically reboot. Both Apple and Google have implemented this ‘inactivity reboot‘ feature, which will ensure that your device is in the most secure state possible, while still being turned on (see next section).

Remote Locate & Wipe

Okay, so what do you do if your phone is lost, stolen or confiscated? That is, what can you do after the fact to mitigate the potential for data theft?

Both Apple and Google have implemented clever mechanisms to help you locate your phone anywhere on the planet – potentially even in areas that don’t have cellular or WiFi coverage. They basically use other nearby Android or iOS devices to listen for secure little ‘pings’ put out by your devices, and will report them in a privacy-preserving way to the network when they can, noting the location where the ping was heard. This allows you to locate your phone from anywhere on the planet. (Google and Apple are even working together to make their “Find My” networks cross-compatible.)

But you can do more than just find the location of your device. You can also remotely wipe the data. If you’ve backed up all your important data to the cloud or your computer, then you can erase all the data on your phone. (That’s a very important “if” – make sure you’ve backed up your photos and files, in particular. Most app data is already backed up to the cloud in one way or another.)

References & How-To Articles

Here’s a list of some key articles that describe how to enable the features I discussed above.

• Apple (iOS): PIN codes, Face ID, Touch ID, Find My, Stolen Device Protection, Remote Wipe
• Google (Android): Screen Lock, Find Hub, Theft Protection, Advanced Protection, Remote Wipe
• EFF Surveillance Self-Defense (iOS)
• EFF Surveillance Self-Defense (Android)
• Border Insecurity
• Freezing Your Mobile Account