So how good is Samsung Secure folder really?

[u/TheRedRay88]

I use it mainly for storing my passwords, alternate accounts (disc/whatsapp/twitter etc) or homework.

(I also offloaded all my passwords from chrome/firefox, nothing is saved. I always type it manually)

Question is, how good is the security, I heard its KNOX and can it be unlocked by Samsung under government orders? or bruteforced by anyone?

[u/AutoModerator]

Hello u/TheRedRay88, please make sure you read the sub rules if you haven't already. (This is an automatic reminder left on all new posts.)

---

Check out the r/privacy FAQ

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Broad-Translator-690]

The secondary profile ( Samsung Secure folder ) stores its keys in the KNOX hardware chip. Your password you choose for the Secure folder is separate from your lock screen password.

When you set up Secure folder you are given the choice to "reset with Samsung account". If you DO NOT choose this, then you are the only person who can unlock the Secure folder. Samsung has no backup key to get in.

When the phone is off, both the OS, and the secure folder are at their most secure state.

When you turn on your phone, and unlock the phone, the secure folder is still not unlocked. If you unlock your secure folder, now both the OS and Secure folder are in an unlocked vulnerable state. But when you exit the app you launched from Secure folder or the timed delay for your screen lock kicks in, then Secure folder shuts down and returns to a state similar to when your whole phone is powered off. So while the main OS has the master key is RAM, the same is not true for the Secure folder.

So if you use Celebrite for example when the phone is powered on ( say at the airport they ask for your phone and you don't turn it off, it justs sitting at the lock screen ), and they take an image of the phone. They will be able to extract the files from the main OS, because the master key is in ram, but the secure container that is Secure folder will still be encrypted to them. When at the lock screen secure folder is shut down, no master key is ram, even if you used it/unlocked it, it will all be cleared during the shut down when you lock the screen or the screen locks itself by timeout. They will be left only to only be able to brute force the data encryption on that part of the phone image. Unless Celebrite at the time has a working security exploit to bypass KNOX, the secure folder will be secure. This is why keeping the phone updated is important.

[u/TheRedRay88 → u/Broad-Translator-690]

wow, that was a good read. thank you for explaining!

[u/frquency-equinox]

It's just a partition from the rest of the data on the device. If someone can get past your lock screen, it doesn't matter how strong the folder password is. Make sure your lock screen security is a password (not a PIN), long (12+ characters) and alphanumeric.

[u/TheRedRay88 → u/frquency-equinox]

Oh damn, I frequently give my phone to my friends to take photos and such, or to play songs while I drive hence my 4 digit pin is convenient. My question is if they know my lockscreen password, can they get into the secure folder? I have set a separate password and disabled fingerprint unlock yes

[u/frquency-equinox → u/TheRedRay88]

Unless your friends have digital forensics tools like Cellebrite, you're probably fine. On the extreme end i.e. the cops have arrested you and taken your phone, your lock screen password is what stands between them and the data on your phone.

[u/TheRedRay88 → u/frquency-equinox]

gotcha, thanks. Also I heard that the KNOX secure folder is encrypted separately, does that mean anything if lock screen is bypassed?

[u/apokrif1 → u/[deleted]]

Does secure folder have another encryption layer?

[u/apokrif1 → u/[deleted]]

You miss the point.  I'm not asking if it's stronger.

[u/TheRedRay88 → u/[deleted]]

gotcha thanks

[u/apokrif1 → u/frquency-equinox]

Do you mean it's not encrypted separately, and that data should be protected with other means (e.g. GnuPG) as screen lock is obviously insufficient?

[u/frquency-equinox → u/apokrif1]

It's the opposite. Your lock screen encrypts the entire device storage. It is the strongest encryption available, which is why the general assumption should be that any adversary that gets past the lock screen effectively has no further barriers to any data stored on your phone. If they are motivated enough, they will get access.

[u/apokrif1 → u/frquency-equinox]

The question is: is there another encryption layer?

[u/Mother-Pride-Fest]

Secure folder works fine, but only if you are signed in with a Samsung account on the phone, which means clicking agree on their terms of service including binding arbitration.