Google on Android Lollipop security: Set it and forget it
Google's lead security engineer on Android thinks you shouldn't have to be a tech whiz to keep your phone secure.
With Android 5.0 Lollipop, Google says, security will be set automatically.The head of Google's Android mobile software security team has a little secret: Although he lives in urban San Francisco, "most days" he doesn't lock the front door to his house.
And he's not worried about it. While it's not clear whether Adrian Ludwig is arrogant, trusts his neighbors too much, or just has a really good insurance policy, his message is that he doesn't think about securing his home when he's not there.
Now Ludwig, the man with the unlocked door, wants you to feel just as safe using your mobile phone and "not think" about Android security, either.
Google is about to release the latest version of its Android mobile operating system with several major security improvements that Ludwig says will help keep user's data safer, even as Android expands from phones and tablets into cars, watches, and other devices.
With its newest release, Android 5.0 Lollipop, Google is changing the way Android security works. This time around, the company said, security will be set automatically.
"I don't think it's realistic that the average person should care about security," Ludwig said in a conference call with reporters during which he highlighted what he considered to be the most important new and updated security features in Lollipop.
The move signifies a change among top smartphone makers from merely offering security features to mandating their use, and at the same time, making them easier to use. With Android powering more than 80 percent of the world's smartphones, it's no longer reasonable to build technology merely for the tech crowd. So Google is taking the approach of rivals such as Apple: Automatically turn on key security features, so customers don't even need to know.
"When it comes to security, we're not designing a single device, or millions of similar devices," Ludwig said of Google's approach. "We're building a service which helps users be secure despite the myriad of different ways that Android might come into play."
Another reason for Google's new take on security is theft. Ludwig said theft and loss are the No. 1 security problem facing smartphone owners today, and it's hard to imagine that they'd disagree. Three million Americans had their smartphones stolen in 2013, almost double the number from the previous year, according to Consumer Reports. Lookout Mobile Security reported phones have been stolen in the US from one in 10 smartphone owners.
Enter the 'kill switch'
Google has three answers to this problem: the lock screen, keeping people from accessing data; encrypting devices to keep all but the most persistent hackers from breaking in; and device manager, which can help to find or remotely wipe a lost device.
Device manager also includes a new feature: a "kill switch" to disable stolen phones. Officially called Factory Reset Protection, it requires the owner's Google password to wipe the phone's data and leave it inoperable. Apple introduced a similar feature for its iPhones and iPads last year, but only turned it on by default in September when it released iOS 8. Lollipop users still have to activate the feature on their devices manually themselves -- for now.
A new California law mandates that all new smartphones sold within the state turn on the kill switch by default by July 1, 2015, and Google has given no indication that it won't comply with the law. When asked why Google doesn't just activate it now, Ludwig claimed that it's Android engineering policy to slowly introduce new security features to Android users for testing purposes.
"Often the case when we're building security features is to provide the opportunity for users to interact with the feature before it's on by default," he said.
While the kill switch may make lawmakers happy, encryption has the opposite effect. FBI director James Comey has railed against moves by Apple and Google to encrypt user data by default on smartphones, even as privacy advocates and technologists hail the change.
While Android has offered opt-in encryption for the past three years, Lollipop encrypts all of a user's smartphone data by default. Ludwig said even as an option, enterprise Android customers have mandated device encryption, and so "millions" of people already are using it.
However, he acknowledged that users who upgrade older Android devices to Lollipop still must activate device encryption on their own, in apparent contrast to iOS 8 which encrypts data on all devices running it, new and old.
Apple did not respond to a request for comment.
Where encryption protects the phone at a deep, operating system-level, Ludwig said the lock screen protects it from the moment users want to use the phone. Lock screen improvements in Lollipop unlock phones and tablets with a second Android device, such as a smartwatch or a car entertainment system, and improvements to facial recognition technology have made Android's older Face Lock tool more effective and easier to use.
3:31 PM
