Hadlee Simons / Android Authority
TL;DR
- An app teardown has revealed that Google could ask users for a security question before activating Remote Lock on Android phones.
- This should make for a more secure experience as Remote Lock currently requires your phone number.
- Google was previously working on a date-based security challenge for Remote Lock.
Google offers a Remote Lock feature on Android phones as part of the company’s Find My Device suite of features. This feature isn’t completely secure, though, and Google previously confirmed that it’s working on an extra layer of authentication. Now, it looks like this authentication method is changing.
An APK teardown helps predict features that may arrive on a service in the future based on work-in-progress code. However, it is possible that such predicted features may not make it to a public release.
We conducted a teardown of the Google Play Services app (version 25.12.61) and discovered that Google is working on a security question feature for Remote Lock. The company could also let you choose a specific question for verification. Check out the second and third strings below.
Code
<string name="fmd_quick_remote_lock_footer_text_new"><b>Keep in mind</b> <ul> <li>Your device must be online. If your device is offline, its screen will lock automatically once it’s online.</li> <li>If you find your device, just unlock your screen the way you usually would, for example, with a PIN or password.</li> <li>Your screen can be locked remotely up to twice a day.</li> </ul></string>
<string name="fmd_quick_remote_lock_security_answer_hint">Your answer</string>
<string name="fmd_quick_remote_lock_security_question_hint">Select a security question</string>.Google currently lets you activate Remote Lock on an Android phone by visiting the Remote Lock website and entering your phone number. That means if someone knows your phone number and has access to a web browser with your Google account logged into it, they could remotely lock your phone. That’s not a huge issue at first glance as you can simply use your biometrics or device PIN to unlock the phone, but it could still be a nuisance. So having to answer a security question first could prevent others (e.g., siblings, your partner, or your children) from remotely locking your Android device.
This isn’t the first time we’ve heard about a security layer being added to Remote Lock, either. Google previously said that it would offer a “security challenge” for the feature, and we were able to get a look at this challenge last year. It turned out that this challenge took the form of a date. That is, you’d need to enter a specific date in order to use Remote Lock.
It looks like this date-based security challenge is now evolving into a more open-ended security question. This should make for a more secure experience, as some people will undoubtedly choose an insecure date like their birthday or anniversary that can be easily found via social media or other means. There’s no word on the specific security questions you can choose from, but other services offer choices like your first pet’s name, your favorite color, or your mother’s maiden name.
