Samsung Knox encryption keys are weak

Knox, Samsung’s security platform, uses weak encryption keys. In addition, the key is stored locally on the device to provide password hints to users. That’s according to a security researcher.

Users had better use Android’s built-in encryption rather than relying on Knox, a security researcher writes. The keys that Knox generates are based on the device ID and a number of hard-coded strings, instead of an actual unique code.

In addition, the keys appear to be stored locally. This is probably done to give users password hints if they forget their code. But if you forget your code, your data must also be lost. “If the data can be retrieved without knowing the code, the data is not secure.” In addition, the PIN that users must enter to request a password hint is stored in plain text, the researcher discovered.

Samsung touts Knox as a platform for companies, with which they can, for example, separate private data from business data. It is striking that the NSA recently approved Samsung Knox for use by the US government. Earlier this year there were rumors that Samsung would stop with the security platform, but that is not true, Samsung later assured.