Where is Secure Start (or Secure Boot) on the S20?

[userQgWZhVaUe2]

On my Note 8, I was able to 'encrypt device', to prompt for a PIN or PW to boot the phone.   I understand on the Note 10, there's a Secure Start option.   Where are either of those options on the S20?   Is it still possible to encrypt the entire device (I've already encrypted the SD card)?

thanks,

daryl

[Andee78 · Accepted solution]

This phone have file based encryption (fbe) which mean you don't need the full disk encryption (fde) feature aka secure startup. 

https://developer.samsungknox.com/blog/samsung-devices-and-file-based-encryption-fbe

https://support.samsungknox.com/hc/en-us/articles/360039577713-File-based-encryption-FBE-and-full-di...

[userQgWZhVaUe2]

This makes the phone less secure, IMHO.  When you encrypt the entire device, the phone won't boot until you pass that phase of authentication.  That way, nobody can't even get into the one (police or whomever) without the password.  Now they can hack the phone since it actually starts and just needs a password to get in.  Far less secure.

[Andee78]

@userQgWZhVaUe2 not true! FBE is far more secure than FDE.

[userRylCWakzat]

FBE is NOT more secure than FDE, it is less so. With FDE the ENTIRE disk is encrypted, not so with FBE. Who gets to decide which files are encrypted with FBE on an Android phone? Do you need to specify each file you want encrypted? What if you miss one? What about the apps that are installed? Are those able to be seen without decryption? I keep my most sensitive work materials secure by 1) Using FDE on my Linux machines requiring a key to even boot the OS. 2) Having my home directory encrypted with a different key. 3) Using a PGP application that keeps files encrypted with yet another key. On my previous phone(an S7) I relied on BOTH FDE and encrypting the most sensitive files with a separate PGP-based application storage.

Essentially by removing FDE you take away the most important safe guards  of privacy on your device. Who thinks this is the result of an NSL being served to Google to allow for backdoors to easily be placed onto your phone?

[usersCx7GB96zU]

Exactly the reason why i dumped my Galaxy S10 phone and will never buy a Samsung phone again.  This kind of security should be top priority! 

Entering a code before the phone starts up is super secure, i really liked that. I find it really annoying that they took that option away, so dumb that you did this Samsung.

So never a Samsung phone for me again, you lost a loyal Galaxy customer... so bye bye Samsung...   

[user5ksXmrJzZ5]

The Samsung had nothing to with ditching Full Disk Encryption (FDE) and replacing it with FBE. 

Per Samsung Docs, the Google forced Samsung into complying with using FBE only on Android 10 and later devices. 

[userUNKCcsAFH4]

Perhaps, theoretically. Correct me if I'm wrong, but the S20 has supposed Government graded encryption and security (provided via Knox and the encryption chip "S3FV9RR", second gen). This protects against hardware attacks, and more specifically password and login attacks, as stated on a Samsung news website "https://news.samsung.com/global/strengthening-hardware-security-with-galaxy-s20s-secure-processor#:~....". This is samsungs substitute to the secure backup, and as stated on Google.co.uk, used a file based encryption, so the files can not theoretically be hacked and stolen. And hacks will become harder and more complex to perform, and apparently this chip is government grade (information from an unknown source).

Just as a piece of mind when purchasing one of these devices, thus information was sourced from a supposed reliable source, so please do not take everything directly to heart as this has a possibility of inaccuracy. But there should be no worry at all with security with this device, good luck for any new S20 users, it will not let you down! (Information may be subject to change, and feel free to correct anything I have said wrong! 🙂 )

[user5ksXmrJzZ5]

No, it will not be added back. Per Android documentation, all new devices launching with Android 10.0 and later are required to have File Based Encryption (FBE). 

Full Disk Encryptions  is a legacy feature now. FBE is much more secure and the new standard now. Please read up the documentations on it. 

https://source.android.com/security/encryption/file-based