Disk Encryption and Screen Lock

Laptops are left in trains and phones fall out of pockets. When this happens, the question is not only "how much does a replacement cost?" but "who can read what is inside?". Encryption and screen locks are the two protections that answer this question. In this lesson you will understand how they work, how to turn them on, and how to avoid locking yourself out.

Updates protect you against remote attacks. This lesson covers physical risk: a lost, stolen or briefly borrowed device. This is a very realistic risk for a phone or laptop, and a great example of the "layers" idea we met in Chapter 1.

The risk of a lost device

Many people believe that a login password protects the files on a computer. Unfortunately, that is only half-true. A login password stops someone from using your system as it is. But a person with physical access can often remove the storage drive, plug it into another computer and read the files directly, bypassing the login screen entirely, like taking the safe out of the wall instead of guessing its code.

Think about what a typical device holds: photos, documents, scanned identity papers, saved sessions on your email and social accounts, tax forms and messages. In the wrong hands, this is enough for identity theft or blackmail.

What is disk encryption?

Encryption scrambles data using a mathematical key, so that it is unreadable without the key. Full-disk encryption applies this to everything stored on the device. It happens automatically and invisibly: when you unlock the device, the data is decrypted on the fly; when the device is off or locked, the disk is just a mass of meaningless data.

The result is significant: if your encrypted laptop is stolen and switched off, the thief gets hardware, not your files. Without your password, PIN or recovery key, the data cannot be practically recovered.

Is yours already on?

• Smartphones and tablets: current versions of the major mobile systems encrypt storage by default as soon as you set a screen lock. A strong passcode is what ties the key to you.
• Computers: modern operating systems include a built-in disk encryption feature, but it is not always switched on automatically. Look in the security or privacy settings for "device encryption" or "disk encryption" and turn it on.
• External drives and USB sticks that carry sensitive files can be encrypted too, with the same built-in tools or with reputable open-source ones.

Prepare for lockout: the recovery key

Encryption works so well that if you lose your password and the recovery key, nobody can help you, neither you nor the maker. When you enable it, the system offers a recovery key. Handle it properly:

• Print it or write it down and keep it somewhere safe at home, not on the encrypted device.
• Do not email it to yourself, and do not store it in an unprotected cloud folder. A secure note in your password manager is acceptable if the manager can still be reached from another device.
• Keep your backups (next lesson) in case something goes wrong with the drive anyway.

Screen locks: the first barrier

Encryption protects a device that is switched off. A screen lock protects it while on. Without a lock, anyone who picks up your phone has access to all your accounts, including the ones where you are already signed in, and the codes sent to the phone. This is a big deal, given how many accounts rely on your phone for two-step verification.

How to choose a good screen lock

• Prefer a long passcode or passphrase over a 4-digit PIN. A six-digit PIN is a minimum; an alphanumeric passcode is better, especially for the phone that holds your second factors.
• Use biometric unlock as a convenience on top of this code, as explained in lesson 2.4. It lets you keep a long passcode without typing it dozens of times a day.
• Avoid easy patterns: birthdays, repeating digits, "123456", and simple gesture patterns that leave a trace on the screen.
• Set a short auto-lock delay, such as one minute or less, so a forgotten phone locks quickly.
• Hide sensitive notifications on the lock screen, which can show messages and verification codes to anybody who glances at the phone.

On computers, lock the screen whenever you leave it, even at home or at work, with the keyboard shortcut for your system. Make it a reflex, like taking your keys.

Find, lock and erase remotely

Your phone and your laptop most likely have a feature to locate, lock or erase the device remotely. It must be activated before you lose the device. Take a few minutes to:

• Enable "find my device" (the name varies) on each phone, tablet and laptop.
• Check that your account for this feature is protected by a strong password and two-factor authentication.
• Know how to use it from another device, such as a family member's.

If a device is lost: first try to locate it and lock it, and put a message with a contact number on the screen. If it appears stolen or unrecoverable, erase it remotely, change the passwords of important accounts, ask your operator to block the SIM card, and report the theft. We will detail the response steps in Chapter 7.

A word about public computers and shared devices

• Avoid signing into sensitive accounts on a computer you do not control, such as one in a hotel or library.
• If you must, use a private browsing window, never save passwords, sign out completely and close the window.
• On shared family devices, create separate user accounts, so that each person has their own settings and files, and the children's account has fewer rights.

Your turn

Exercise. Check the protection of the devices you carry. For your phone and your computer, answer: Is the storage encrypted? What kind of screen lock is used? What is the auto-lock delay? Is "find my device" enabled? Where is the recovery key?

See a solution

1. Encryption: on a phone, setting a screen lock usually turns it on; look for a status line in the security settings. On a computer, search the settings for "encryption"; turn it on if it is off, and save the recovery key somewhere other than the computer.
2. Screen lock: choose a passcode of six digits or more, or a passphrase; enable fingerprint or face unlock for convenience.
3. Auto-lock: set 30 seconds to one minute for the phone, and a few minutes for the computer.
4. Find my device: enable it and test locating the device from another one.
5. Notifications: hide the content of messages on the lock screen.

Add to your Security Notebook

Under "3. Devices", add for each device: encryption on or off, lock type and delay, remote-locate enabled, and the location of the recovery key. Then fix at least one gap today.

Encryption protects against theft, but not against a failed disk, an accidental deletion or ransomware. For those, you need backups.