swillden writes: There’s been a lot of discussion of what, exactly, is meant by the Apple announcement about iOS8 device encryption, and the subsequent announcement by Google that Android L will enable encryption by default. Two security researchers tackled these questions in blog posts: Matthew Green tackled iOS encryption, concluding that the change really boils down to applying the existing iOS encryption methods to more data. He also reviews the iOS approach, which uses Apple’s "Secure Enclave" chip as the basis for the encryption and guesses at how it is that Apple can say it’s unable to decrypt the devices. He concludes, with some clarification from a commenter, that Apple really can’t (unless you use a weak password which can be brute-forced, and even then it’s hard). Nikolay Elenkov looks into the preview release of Android "L." He finds that not only has Google turned encryption on by default, but appears to have incorporated hardware-based security as well, to make it impossible (or at least much more difficult) to perform brute force password searches off-device.
Read more of this story at Slashdot.