How easy is Full Disk Encryption on FP5/FP6?

How easy is it to set up FDE on the FP6 with /e/ pre-installed?
Is this provided for in the initial set-up out of the box, or will I need to flash the ROM afresh myself?

How easily can you install /e/ or LineageOS on the FP5 with FDE?
When I installed LineageOS on my FP2 it was quite straightforward to enable FDE, but now the poor old thing is going the way of Biden and I need to replace it, so I’m very much hoping that the later designs haven’t repeated anything like the FP2’s features.

Senile FP2 Details

The issues with my FP2 give quite a funny example of what someone will put up with while too stuck in a combination of stubbornness and a poverty trap to get a new device.

  • The broken main microphone was easy to work-around with a hands-free kit, and was practically a privacy feature, so I’ve gone for many years without it. However, the bouncy Micro USB connection has been a frequent nuisance no matter how much I clean it, with even very minimal use on a cable, so it has been annoying since bottom modules were no longer stocked and the guy who designed a USB-C alternative went incommunicado right before I tried to contact him.
  • The original rubberised casing was nice, and I was sad when it started to fall apart where it joined onto its rigid backing. The instant explosive dis-assembly of case and battery caused by dropping the ‘slim’ case on to a rigid surface could be any mixture of hilarious and enraging depending upon the context.
  • The random sudden reboots were probably the worst feature. I worked out after a while that they are far more frequent if my FP2 is left plugged in overnight, so counter-intuitively I can’t leave it on charge for risk of my alarms failing to go off and leaving me late for work as random reboots combine poorly with FDE, but that won’t completely stop it from doing so.
  • The above two features would also sometimes compromise, where falling a very short distance or onto a soft surface would result in a reboot instead of exploding the phone.
  • The supposed LTE compatibility, yet inability to make calls or texts or browse while supposedly having ¾ signal strength is bizarre, and I’m guessing possibly some of those springy connectors that dig ruts into the soft metal of the screen back having nothing to make contact with anymore might be why this happens, even despite cleaning the connections up, and why there is no signal at all half the time until I knock the phone on my desk in just the right way. Dancing around to find a crumb of real signal and hear the voicemails for the calls I never received has been good for getting me some fresh air and a little exercise, but not good for dealing with bureaucrats who will only phone you and nothing else.
  • The latest feature that was only released last month is maybe the most fascinating one, as when something gradually comes loose inside, the screen will randomly start showing colourful heavy distortion and then either white noise or flat black until I give it a few good hard whacks on the nearest desk or wall in particular directions until whatever is loose re-seats itself again. It does this nearly every day now. Strangely, the touchscreen often still works while this provides no view of what is being tapped on.
  • Along with this sometimes came the battery suddenly thinking it had about half or a quarter of the charge that it had a second before the phone was knocked, and charging it in this state can result in it taking a couple of hours to get hardly anything, only to then suddenly realise that it is fully charged. Knocking it in the right direction again could restore the ‘lost charge’, as if there was too much resistance on one of the connectors in some position, but sometimes it seemed like it really had lost that charge instantaneously. However, I think I’ve reduced the appearance of this feature by cleaning up the battery contacts a bit more.

No, I’m not exaggerating any of this. I wish I was, instead of understating it.

Looking at the difference in specs between the FP5 and FP6 (with /e/) on their respective shop pages (very minimal, and in several cases a step back), I’m baffled as to why the latter exists except to make it a bit smaller, more expensive, and regress to 25-year-old USB 2.0 speeds for some reason??
Did the FP5 have some serious flaws that needed to be resolved in the FP6 or am I missing something?
Neither one mentions encryption as an option anywhere on their shop pages though.

I sincerely doubt that this is still possible, as post-Android 10, devices no longer support full-disk encryption (FDE) in favor of file-based encryption (FBE). FBE is used by default and wouldn’t need to be enabled.

Only devices that launched with Android 9 or lower can use full-disk encryption.
Source: Full-disk encryption  |  Android Open Source Project

4 Likes

Damn, FBE sounds a lot like home-folder encryption, which people stopped doing on desktop Linux years ago because ecryptfs was not as secure and in general it potentially allows anyone who gets brief access to your device to tamper with system files. :frowning:
It sounds like there may be some different benefit in using unique file keys though, so I’ll consider this.
Thanks for the update!

There’s not much to consider or to mention. FBE is enabled by default and mandatory in Android for a while now. It’s not an option, you don’t get to choose.

Not with a locked bootloader, which is the default state the phone comes in, in connection with a screen lock which you set yourself.
But here you get to choose. You can unlock the bootloader, and you can choose a screen unlock method or not.
(The Fairphone 2 bootloader came unlocked and was not lockable.)

6 Likes

Actually, also on Linux Desktop the FBE is still a valid choice, for instance here we use it to encrypt different users home dirs so they can’t access each others files. This is not feasible with FDE. And the new ext4 kernel level encryption is much safer and faster than the old solutions like ecryptfs. I believe MacOS is also choose FBE model for their FileVault implementation for the same benefits.

And remember that any disk encryption only helps for data in rest. So also with FDE it is still possible to alter encrypted system files on disk when your system is running and gets hacked. That is most often a far more likely attack vector than someone physically and secretly altering your files when the device is turned off.

4 Likes

Going off topic, but what distro do you use? I don’t think I’ve ever seen FBE as an installation option on desktop before. Sounds good.

Just Ubuntu with fscrypt installed and some helper scripts.

The nice thing about FBE is that you can easily apply it afterwards(1). Also for instance on old intallations or USB drives that are ext4 formatted. No reformatting necessary.

  1. That only secures data written to encrypted directories afterwards of course, not on old data already unencrypted on the volume.