Locate and wipe Android. Family link?

ChilliBob

Guys, I've had a couple of incidents recently where I have lost my phone. Fortunately on both occasions it was either handed in or found. Both have taught me that I need a plan in place should I lose it again and am unable to find it. (Fingers crossed it'll never be needed!).

I can see from my laptop I can be logged into my Gmail account, open the find my phone page and hey presto it'll locate it, and wipe it. Great!

Now on the go I'm wondering what the options are to do this from say my wife's Android, or a friend's. 

As we have children I have recently started the whole family link thing, setting up a chromebook for my 5 year old.

If my wife is 'invited' to this family group could we use each others phones to find and wipe each others?

If not, is there a more slick option than having to use a non chrome browser (e.g. Firefox) on an Android, logging in to your Gmail and doing it from there?

I just forsee if you really need to use this you're probably going to be in panic mode anyway so you want something slick and clear. 

Thoughts much appreciated. 

I'm aware the situation for me and my wife would probably be different to that of say s friend, where obviously you'd not want such a close tie in most cases!

I actually have just wiped an old android (directly) so could pretend this is one of our phones somehow and give the plan a try. 

DullGreyGuy

Can't you go to android.com/find from any computer and access the account to find/lock etc the phone? Certainly with Apple you can and it doesnt trigger the normal 2FA to log in as it does when accessing other services

ChilliBob

From a laptop, yes, from a phone its a bit more fussy as you'd be reliant on the phone having a second browser, not just chrome. I'd bet most android users would only have Chrome 

DullGreyGuy

ChilliBob said:

From a laptop, yes, from a phone its a bit more fussy as you'd be reliant on the phone having a second browser, not just chrome. I'd bet most android users would only have Chrome 

Even in Incognito mode?

Can they not temporarily log out of Chrome? Cant remember lst time I used one if the log ins were independent or fixed by the phone. 

k_man

The android.com/find page has an option in Manage accounts menu which opens incognito mode.

There is also the Find my device app for Android.
This allows login as a guest/different user.

ChilliBob

k_man said:

The android.com/find page has an option in Manage accounts menu which opens incognito mode.

There is also the Find my device app for Android.
This allows login as a guest/different user.

Cheers, I think that app might be the sort of thing I had in mind. 

I think the family link thing would just allow me to manage and erase a child's phone. 

ChilliBob

DullGreyGuy said:

ChilliBob said:

From a laptop, yes, from a phone its a bit more fussy as you'd be reliant on the phone having a second browser, not just chrome. I'd bet most android users would only have Chrome 

Even in Incognito mode?

Can they not temporarily log out of Chrome? Cant remember lst time I used one if the log ins were independent or fixed by the phone. 

I hadn't thought of Incognito mode actually, one to bear in mind on some circumstances, thanks. 

[Deleted User]

Personally, I wouldn't be in such a hurry to wipe your phone when you lose it.

Glad that you are thinking this through but there are a few things to consider about wiping your phone:

1. If you have 2FA on your Google Account, then how will you get your 2FA code without your phone? There are alternatives such as having an offline copy of your 2FA recovery codes.

2. If you haven't got 2FA on your Google account - why not?

3. If you issue a remote erase, you can no longer track the device location and therefore reduce your chance of finding it. I'd only consider a remote erase in the event of definite theft where you don't expect to retrieve the device. Being able to call the phone or track the location is useful so think carefully before wiping.

4. Remote erase might not erase an SD card - make sure this is encrypted if you have an SD card with personal data.

5. If you have good security on your phone already, there shouldn't be any worries about somebody accessing the phone, make sure it is secured with a minimum 6-digit PIN and a short idle timeout that locks the phone after 1 minute. Also, enforce delayed lockout for too many incorrect PIN attempts.

6. A bigger concern is the SIM card, this can be more valuable than the phone as it can be put it any other phone and used for calls, data messages, etc, and worst case is either running up a large bill or scamming your family or friends that contact you on that number - look to put a PIN lock on your SIM and if you don't then you would want to consider blocking it soon after being lost but then bear in mind it will not longer have a data connection and therefore tracking/wiping the phone will not be possible so do that before blocking the SIM.

7. And as per above, remote wipe therefore may not be possible if somebody removes the SIM from the phone.

So, if the phone is genuinely just lost and/or in the hands of an honest soul who wants to return it to you, then wiping it isn't always the best option.

If your phone is stolen or ends up in the hands of somebody who wants to profit from that phone, then your SIM is vulnerable and likely to be removed soon anyway losing the opportunity to wipe or locate the phone. In this case, your best defense is a SIM PIN lock and/or contacting your network provider to block the SIM (after issuing a remote wipe).

ChilliBob

[Deleted User] said:

Personally, I wouldn't be in such a hurry to wipe your phone when you lose it.

Glad that you are thinking this through but there are a few things to consider about wiping your phone:

1. If you have 2FA on your Google Account, then how will you get your 2FA code without your phone? There are alternatives such as having an offline copy of your 2FA recovery codes.

2. If you haven't got 2FA on your Google account - why not?

3. If you issue a remote erase, you can no longer track the device location and therefore reduce your chance of finding it. I'd only consider a remote erase in the event of definite theft where you don't expect to retrieve the device. Being able to call the phone or track the location is useful so think carefully before wiping.

4. Remote erase might not erase an SD card - make sure this is encrypted if you have an SD card with personal data.

5. If you have good security on your phone already, there shouldn't be any worries about somebody accessing the phone, make sure it is secured with a minimum 6-digit PIN and a short idle timeout that locks the phone after 1 minute. Also, enforce delayed lockout for too many incorrect PIN attempts.

6. A bigger concern is the SIM card, this can be more valuable than the phone as it can be put it any other phone and used for calls, data messages, etc, and worst case is either running up a large bill or scamming your family or friends that contact you on that number - look to put a PIN lock on your SIM and if you don't then you would want to consider blocking it soon after being lost but then bear in mind it will not longer have a data connection and therefore tracking/wiping the phone will not be possible so do that before blocking the SIM.

7. And as per above, remote wipe therefore may not be possible if somebody removes the SIM from the phone.

So, if the phone is genuinely just lost and/or in the hands of an honest soul who wants to return it to you, then wiping it isn't always the best option.

If your phone is stolen or ends up in the hands of somebody who wants to profit from that phone, then your SIM is vulnerable and likely to be removed soon anyway losing the opportunity to wipe or locate the phone. In this case, your best defense is a SIM PIN lock and/or contacting your network provider to block the SIM (after issuing a remote wipe).

Thank you for the comprehensive reply, it's most appreciated. In what almost feels like a previous life I did a few years as a sys admin and other tech based roles so most of what you're suggesting I think I have covered...! But not all, and it's always good to check up and bolster your defences. 

2FA - Yes, this is enabled. Backup codes, I'd forgotten about them!.. But I was sorting my one drive and google drive yesterday (a whole new tale, with replication between them going a bit awry!) and stumbled upon them. I've created new ones and put them in LastPass.

The value of the handset, in this situation, would be my last concern vs the information available on it, hence why remotely wiping it was an attractive prospect, but yeah, point taken - someone stealing it from your very eyes vs misplacing it are quite different situations.

My PIN is only 4 characters now you mention it, I think I'll increase it I do have the screen to lock after 30 seconds I think. 

Enforced lockout is an interesting one - I'm not sure what the options are on Android, I think not too many. I'd also be concerned what happens at this point - I'd not want my son to play around with it, press buttons and it wipes!

Yes, the SIM does have a lock, and I'd contact my provider if it was stolen, the bill element isn't a concern as I'm not on a contract like that, the scamming relatives would be more of my concern really.

Thanks again for the detailed reply - reminds me of eons ago setting up a bunch of Blackberries and iPhones on rackspace and seeing the kill device option - we're talking probably 15 years ago now scarily :0