Device Encryption Verification
Replaces: Unencrypted or default-encryption devices
Verify encryption is enabled on every device and strengthen your PIN or passphrase against brute-force attacks.
Sources
data-breachphysical-theftgovt-surveillance
Phase
Settings Changes — no install, no account, 5 min
Android
Phones encrypt by default since Android 6.0 (2015). Verify: Settings → Security → Encryption & credentials. Set PIN to at least 8 digits (Settings → Security → Screen lock). A 4-digit PIN can be brute-forced in under 3 hours.
iOS
iPhones encrypt by default since iOS 8. Verify: Settings → Face ID & Passcode. Set passcode to at least 6 digits, preferably alphanumeric. The Secure Enclave enforces rate limiting on unlock attempts.
General
Phones: encryption is on by default, but verify it and strengthen the PIN. The encryption is only as strong as the passphrase protecting the key.
Desktops/laptops (Phase 2 upgrade):
- Windows: BitLocker (Pro/Enterprise). On Windows 11, may be auto-enabled with Microsoft account — check if recovery key is uploaded to Microsoft and move it offline. Home edition: "Device Encryption" only.
- macOS: FileVault 2. Enable in System Settings → Privacy & Security. Store recovery key locally, NOT in iCloud.
- Linux: LUKS2 at install time. Harder to add after the fact.
Key points:
- A locked phone is weaker than a powered-off phone (After First Unlock state retains keys in memory)
- For travel/border crossings: power off, don't just lock
- Cloud backups may be unencrypted or encrypted with a provider-held key — check backup encryption settings
Desktops/laptops (Phase 2 upgrade):
- Windows: BitLocker (Pro/Enterprise). On Windows 11, may be auto-enabled with Microsoft account — check if recovery key is uploaded to Microsoft and move it offline. Home edition: "Device Encryption" only.
- macOS: FileVault 2. Enable in System Settings → Privacy & Security. Store recovery key locally, NOT in iCloud.
- Linux: LUKS2 at install time. Harder to add after the fact.
Key points:
- A locked phone is weaker than a powered-off phone (After First Unlock state retains keys in memory)
- For travel/border crossings: power off, don't just lock
- Cloud backups may be unencrypted or encrypted with a provider-held key — check backup encryption settings
Related Cards
Research Findings
Full-disk encryption protects data at rest (powered-off device). Does not protect a running/unlocked system. Phones encrypt by default since 2015+ but most users have weak PINs. Desktops need explicit setup. BitLocker on Windows may auto-upload recovery key to Microsoft account — a privacy concern. LUKS2 uses Argon2id KDF (strongest). VeraCrypt offers hidden volumes (plausible deniability). AFU (After First Unlock) state is cryptographically weaker than BFU (Before First Unlock) — power off for maximum protection.