0

Is there anything inherently insecure about using a dedicated Android phone as a "hardware wallet"?

A dedicated phone implies:

  • a clean ROM without gapps, i.e. Lineage OS without root

  • full phone encryption enabled

  • no other apps installed apart from a wallet app such as Mycelium, Breadwallet, GreenBits, Samurai, etc.

I realize that Android phones don't have a secure element like trezor or ledger devices, and that system apps might have unlimited privileges, but what are the main issues or specific attack vectors to be aware of in such a setup as compared to dedicated hardware wallets?

My understanding is that physical access to a trezor or ledger is useless if the attackers don't have the pin or passphrase and that these devices are built in such a way as to make hardware extraction of private keys impossible or financially unfeasible.

Is a comparable level of security achievable with an Android device with full phone encryption?

Also, does setting a pin code in a software Android wallet mean that the private keys are actually going to be encrypted or is the pin just for opening the UI?

Any data on which wallet apps protect the keys in a way which makes their extraction impossible without the pin code/fingerprint?

1

Is a comparable level of security achievable with an Android device with full phone encryption?

Short answer: No. This doesn't mean an Android device is bad, there are less secure ways to store bitcoins. But it does have more attack vectors than a hardware wallet.

You can add whatever encryption to the phone you'd like, but ultimately if that device can connect to the internet, there is risk that some malware could be loaded to it. A hardware wallet is not at risk of this type of attack, the secure element is kept isolated from the internet.

For example, if screen capture malware is loaded onto the Android device, and it snaps a screen grab of your seed phrase, the encryption methods won't matter at all. This sort of attack isn't possible on a hardware wallet.

  • For any malware to be loaded it has to be installed, and, as stated in the original question, the device is not going to have any apps installed apart from the wallet, and is not going to be used for web browsing or email - it's gonna be used exclusively as a wallet. How can any malware make its way to the device in this case? The apk is gonna be side-loaded, and possibly built from publicly available sources. Updates for system components would require the same certificates as the ROM, so that's probably not a vector. – ccpizza Dec 8 '17 at 18:57
  • If a device can connect to the internet, then the attack surface increases. End of story. There are ways to mitigate this risk (your plan is okay in this regard), but ultimately: the phone is designed and engineered to connect to the internet. It is hard to turn this functionality off entirely. If ANY data flows into the device from outside, there is the risk of a malicious payload. A hardware wallet doesn't have wifi, cellular, bluetooth functionality, so these attack vectors are removed, instead of just reduced. – chytrik Dec 8 '17 at 19:59
  • i do understand the software risks, and there are recorded cases of phones that shipped with rogue system apps that "phoned home"; my assumption is that it might be mitigated by using a verified custom ROM; what's still not clear is how vulnerable is Android hardware, ie compromised chips, controllers, graphics and any kind of manufacturer's backdoors because most of the devices we use are basically "black boxes" in terms of low level hardware. – ccpizza Dec 8 '17 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.