This is alarming, if true: according to a group of German security researchers at the University of Erlangen, if you put a locked, encrypted Android phone in the freezer for an hour and then quickly reboot it and plug it into a laptop, the memory will retain enough charge to stay decrypted, and can boot up into a custom OS that can recover the keys and boot the phone up with all the files available in the clear. The attack is called FROST: "Forensic Recovery Of Scrambled Telephones," and it requires a phone with an unlocked bootloader to work.

At the end of 2011, Google released version 4.0 of its Android operating system for smartphones. For the first time, Android smartphone owners were supplied with a disk encryption feature that transparently scrambles user partitions, thus protecting sensitive user information against targeted attacks that bypass screen locks. On the downside, scrambled telephones are a a nightmare for IT forensics and law enforcement, because once the power of a scrambled device is cut any chance other than bruteforce is lost to recover data.

We present FROST, a tool set that supports the forensic recovery of scrambled telephones. To this end we perform cold boot attacks against Android smartphones and retrieve disk encryption keys from RAM. We show that cold boot attacks against Android phones are generally possible for the first time, and we perform our attacks practically against Galaxy Nexus devices from Samsung. To break disk encryption, the bootloader must be unlocked before the attack because scrambled user partitions are wiped during unlocking. However, we show that cold boot attacks are more generic and allow to retrieve sensitive information, such as contact lists, visited web sites, and photos, directly from RAM, even though the bootloader is locked.

FROST: Forensic Recovery Of Scrambled Telephones

Katie sez, "The video profiles software developer Austin Meyer, who is the target of a patent troll lawsuit involving a company called Uniloc, which owns a patent for the "System and Method for Preventing Unauthorized Access to Electronic Data." Meyer's flight simulator app X-Plane, like most paid applications on the Android market, uses the authorization system. Uniloc purchased the patent in question at a bankruptcy proceeding. Despite the enormous risk, and the enormous cost just to defend against a patent suit, Meyer is resolved to do so. The broader point of the video is that something needs to be done to stop patent trolls from simply buying patents in order to intimidate innovators into paying them a settlement. Patent trolls are a huge tax on innovation and add nothing to the marketplace."

How Patent Trolls Kill Innovation (Thanks, Katie!)

After my event at Austin's Book People on Feb 22, I'll be doing a benefit for EFF-Austin on their location privacy campaign. We did this the last time I came through town and it was tremendous -- come on out!

An evening with Cory Doctorow and EFF-Austin

You will have heard that the US Copyright Office has lifted the temporary ruling under which you were allowed to unlock your phone. EFF explains in detail what this ruling means (it's not what you think -- and in some ways, it's worse):

First, the good news. The legal shield for jailbreaking and rooting your phone remains up - it'll protect us at least through 2015. The shield for unlocking your phone is down, but carriers probably aren't going to start suing customers en masse, RIAA-style. And the Copyright Office's decision, contrary to what some sensational headlines have said, doesn't necessarily make unlocking illegal.

Unlocking is in a legal grey area under the DMCA. The law was supposed to protect creative works, but it's often been misused by electronics makers to block competition and kill markets for used goods. The courts have pushed back, ruling that the DMCA doesn't protect digital locks that keep digital devices from talking to each other when creative work isn't involved. And no creative work is involved here: Wireless carriers aren't worried about "piracy" of the software on their phones, they're worried about people reselling subsidized phones at a profit. So if the matter ever reached a court, it might well decide that the DMCA does not forbid unlocking a phone.

Now, the bad news. While we don’t expect mass lawsuits anytime soon, the threat still looms. More likely, wireless carriers, or even federal prosecutors, will be emboldened to sue not individuals, but rather businesses that unlock and resell phones. If a court rules in favor of the carriers, penalties can be stiff - up to $2,500 per unlocked phone in a civil suit, and $500,000 or five years in prison in a criminal case where the unlocking is done for "commercial advantage." And this could happen even for phones that are no longer under contract. So we're really not free to do as we want with devices that we own.

All that said, if you were convicted, the maximum penalty under the law for unlocking your phone is now greater than the maximum penalty for turning it into an IED.

Is It Illegal To Unlock a Phone? The Situation is Better - and Worse - Than You Think

Nicko sez, "Sitegeist is a free Android and iPhone app from the Sunlight Foundation that helps you to learn more about your surroundings in seconds. Sitegeist takes public data about the people, housing, history, environment and things to do for any U.S. location and presents it in easy-to-view infographics. Just scroll and swipe your way through the categories to get a feel for the area. Everything from age distributions to political contributions and median home values to record temperatures. It makes complex localized data easy to understand so you can get back to enjoying the neighborhood. The app incorporates publicly available data from a number of sources including the U.S. Census Bureau, InfluenceExplorer.com, the Dark Sky weather API and even Yelp and Foursquare. Sunlight will continue to add and improve on the app as more rich data becomes public."

(Thanks, Nicko!)

A Federal Trade Commission report on data-collection in kids' apps paints a dismal picture of compliance with privacy and data-collection regulations. The survey found that most apps aimed at small children failed to disclose their data-collection practices.

The agency reviewed 400 of the most popular children’s apps available on Google and Apple platforms, and reported that only 20 percent disclosed their data collection practices.

“The survey results described in this report paint a disappointing picture of the privacy protections provided by apps for children,” the report said.

Regulators said they were investigating whether the practices of certain apps violated a federal law requiring Web site operators to get parents’ permission before collecting or sharing names, phone numbers, addresses or other personal information obtained from children under 13.

It's part of a larger pattern of dysfunction with electronic media and kids. For example, the license agreement for all the online ebook stores says that you're not allowed to lend or share your ebooks, but they also all heavily promote books aimed at children who are too young to have their own credit-cards. Judging from the license agreements, these bookstores expect that their electronic kids' picture books are being bought by grownups for their own consumption, and not for "sharing" with the children in their lives.

Apps for Children Fall Short on Disclosure to Parents, Report Says [NYT/Natasha Singer] (Thanks, Peter!)

My family have been using the Google Nexus 7 Tablets since they shipped in July. We've carried them on several trips, dropped them dozens of times, used them at home, work, and on holiday, and the unanimous verdict is that these are just delightful little tablets.

The Nexus 7 is the first tablet in the "Nexus" line (Nexus devices receive Google's official stamp of approval, ship unlocked, and run stock Android operating systems without any vendor crapware). Unlike the first highly trumpeted Android tablets -- particularly the Samsung Galaxy Tab 10.1, which I reviewed last year -- the Nexus seems to have been designed with users in mind first, and corporate profits second. Unlike the Samsung tablets, it uses a standard charging cable (something that's especially nice when you're travelling, as it means one fewer cable in the bag) that can be purchased from lots of vendors for cheap. It doesn't come with any crapware, and updates itself directly from Google when Android gets a refresh (mine refreshed itself yesterday).

I've used a lot of ~7" devices before -- Nooks, Kindles and Kobos -- and have always found that a couple weeks in my pocket or gear-bag were sufficient to completely destroy them. The ereaders don't have super-tough Gorilla Glass screens, and none is rugged enough for the kind of klutzy, overburdened travel I end up on. I reluctantly abandoned ereaders a year ago, after killing six in as many months. I say "reluctantly," because I'd really come to love the 7" form-factor, perfect for holding in one hand while on the go, perfect for bedtime ereading. It's also a great size/weight to keep in a bag all the time, rather than deciding on a day-to-day basis whether to pack it along. 7" tablets are in the grey-zone between a phone and a tablet, and I stopped bothering to remove it at airport checkpoints in the UK and US. About 90 percent of the time, no one seems to care, and I've got one fewer thing to fiddle with on my way through security. Finally, it's a good size for little hands as well as grown-up ones.

So I was happy to once again be in possession of a 7" tablet. I've found the Nexus 7 to be a breeze to use. Jellybean, the latest iteration of Android, has plenty to love about it, including the Google Now predictive search that uses your location and search-data to guess at the information you'll be needing. For once, this feels like a good privacy quid-pro-quo: if I let Google see some of my data, it will use that to actually feed me back useful information, including things like daily exchange rates while I'm travelling overseas, a pedometer that uses the built-in accelerometer to count my steps, and travel times to places I've recently looked up. I don't use a Google calendar for most of my scheduling (I'm uncomfortable with giving the company this information), so there's some functionality I'm not seeing, and I'm happy to be making that trade off.

The Google Play store -- where apps and entertainment can be downloaded either for free or money -- is pretty good. My wife deals with both iOS and Android (she's co-founder of a startup that needs to work on both) and tells me that the Play Store's apps are up to anything in the Apple App Store. Even better is the fact that I can easily and legally opt to buy apps from rival stores, including those operated by Samsung and Amazon, or from independent developers. iOS devices like the iPhone and iPad are designed to thwart efforts to install software that Apple has not blessed. Apple doesn't just reject apps due to quality concerns, either -- for example, the company forbade its users from accessing an app that reported on US drone-strike deaths overseas. Whatever your feelings about the politics of drones, I think most of us would agree that it's none of Apple's business if you want to find out more about this subject. Worse, it's illegal in most places to jailbreak phones and tablets to allow for unauthorized installations (a temporary reprieve for this regime exists in the US, but it only covers phones and not tablets, and does not legalize providing jailbreaking services, which means that iPhone owners must use illegal, unregulated software to liberate their phones, and have no practical way of knowing if the jailbreaking programs are leaving their phones in insecure states). And Apple has spent lots of money lobbying regulators to keep jailbreaking illegal. As a creator who earns his living from copyright, I want to use and encourage platforms that don't give mere electronics companies a veto over my right to sell my products to my audience (this is such a no-brainer that it's amazing that governments keep getting it wrong: it's a triumph of lobbying over common sense and simple justice).

The specs on the Nexus 7 are great. The high-resolution touchscreen is crisp and responsive. The battery life is exemplary. The processor spec has hit that sweet-spot where the tablet always seems faster than the apps I want to run on it, meaning that I never feel like it is sluggish or delayed. The WiFi access is reliable, even on troublesome 802.11n networks -- in fact, when I find myself in situations where a laptop won't talk to an 802.11n network, I sometimes log my Nexus 7 into the network instead and then tether it over USB to the recalcitrant laptop, using it as an impromptu WiFi adapter. Tethering with all Android devices is so easy that it should be the model for the whole industry. I first discovered the joy of tethering when I was a MacOS user and discovered that it only took a few clicks to use a laptop to share a wired connection over Ethernet or vice-versa. This is still possible with MacBooks, as far as I know, but it came late to both Android and iOS, and the one time I tried it with someone else's iOS device, it was a cumbersome process involving Bluetooth pairing, and only allowed one device to share the connection. With Android devices, it's a matter of a couple taps to turn the tablet or phone into a WiFi hotspot.

The Nexus 7 doesn't come with built-in cellular data (there's a forthcoming version that supports HSPA+, one of the 4G "standards"). I usually get it online with WiFi (at home, hotels, the office) or by tethering it to my Android phone (a Samsung Galaxy Nexus -- I've figured out that I'm never disappointed if I just buy a Nexus-branded device). I don't find that to be a real drawback -- in fact, I prefer only paying one connectivity bill, using my phone as the cellular Internet hub for my laptop and tablets, rather than paying a subscription fee for each.

Getting set up on the Nexus 7 was very easy. All my apps were visible and trivial to download and configure, once I'd logged it into my Google account (I wish there was an alternative to using Google as the sole provider for the activation stuff, and hope that something will surface). I use Firefox for Android -- a fabulous browser, which I prefer to the built-in one supplied by Google -- and it synchs with my desktop Firefox, using an encrypted data-transfer that allows me to share passwords, history and bookmarks between devices without giving the Mozilla Foundation (or someone serving a warrant on them) the ability to read my data. I use K9 mail to access the POP-mail server I use, and NewsRob to read and manage RSS. The official Twitter client works well, too (though I really, really wish it would synch up a killfille of people whose tweets shouldn't be shown to me, even if they @ me -- other clients support this, but don't synch up across devices).

Notwithstanding all of the above, there's still some room for improvement with the Nexus 7. First of all, Google needs to sort out MTP, the file-transfer system it borrowed from the defunct Microsoft Zune. Theoretically, this is superior to simply presenting the tablet as a USB mass-storage device because it allows users to load and unload files from the tablet using their desktops while continuing to use the tablet. This would be nice. But in practice, MTP just sucks. The Linux support is so complex and clunky that it might as well not exist at all (ironic, given that Android is a flavor of GNU/Linux). Mac user friends tell me the same is true for them. I've basically given up on using MTP to transfer files at all. Instead, I use Airdroid, an app that transfers files over the local network using a browser. That works OK, but it's a poor second-best to what we used to have, in the days before Android went MTP. It's been more than a year since that day, and it still sucks. That is inexcusable, and I imagine it's a dealbreaker for some users.

The Nexus 7's physical design is close to ideal, but the power and volume buttons are a little close together, and sometimes trying to turn it down results in turning it off. There's only one (front-facing) camera, which is great for Skype and recording yourself talking, but isn't up to much else, packing only 1.2 megapixels. The lack of a rear-facing camera means that you'll still want to carry around a phone or camera on holiday, since it's tricky to shoot with a device where the viewfinder and the lens are facing the same direction, unless you're shooting self-portraits.

The built-in software suite could use some tweaking. The "Gallery" app plays videos, but not many formats. I'm always forgetting which video app supports which formats, and I've often thrown a ripped DVD or downloaded YouTube video on the device to watch later (or as a last-ditch toddler hypnotizer), only to discover that I've got the combo wrong again. The Play Videos app (which accesses a DRM-crippled video store) would be a natural place to organize videos, and to play them back without hassle. Likewise, the built-in Play Books app is fine for buying ebooks (though it's very hard to tell which of these are DRM free), but it sucks as a hub for all the ebooks you toss at the device. Having to figure out which app is needed for which format has been a solved problem since the mid-nineties, when all the browser vendors finally started supporting all the different graphics formats in use. Format wars are stupid, wasteful and frustrating, and as Joshua learned, "the only way to win is not to play."

Google also needs to work a bit on the software updating process. If you use your Android device every day (as I do, with my phone), it's no problem to run app updates as they show up. But if you put a device away for a few weeks -- which happens with the Nexus 7 -- you might come back to dozens of waiting updates, each of which has to be tediously clicked through and approved. It would be much better to have an "update all" option.

But the Nexus 7 is not only a good device in its own right, it's also a huge step forward toward user-centric, innovation-friendly products that are both excellent in and of themselves, and part of a great ecosystem of developers, retailers, and creators. Best of all, it's relatively cheap: $237 from Amazon resellers or $249 from Google for the 16GB model (compare with the $329 starting price for the iPad Mini, its most direct competitor). They're selling well, too: Asus, who manufacture the Nexus 7, claims to be selling about a million of these every month.

Google Nexus 7 Tablet

Red Ferret reviewed Liquid Armor, a "nanotech" spray that you apply to your mobile device screen in order to prevent it from scratching. They found it very effective and easy to use:

All in all we were very surprised (really!) to find that the coating does seem to actually work. It’s hard to believe that a spray on coating can have that much effect, but unless we’re missing something, it does appear to protect the screen very well indeed under stress. It works with glass of course, so don’t expect the same results if you have a cheaper plastic screen, and it pays to remember that the spray needs to be re-applied every 3 to 6 months to maintain protection.

Overall, we’re going to give it a 5 out of 5. Easy to apply, effective, low impact on screen functionality and not too expensive. We’d like to hear from more real world experiences, but for now it’s a thumbs up recommendation from us.

Liquid Armor – hardcore phone screen protection from a simple nano spray [Review]

This week's issue of Entertainment Weekly sports a live-tweeting interactive video display. The folks from Mashable did a teardown to see how this was accomplished, and discovered that there is a complete (albeit without a case or keypad) Foxconn Android phone glued between the pages, along with a T-Mobile SIM. By poking around, they were even able to make phonecalls with it.

They didn't show what happened if you put the SIM in another phone, which would be a neat trick, and I also wondered about the injunction to turn off mobile devices for takeoff and landing.

We Found a Free Smartphone Embedded Inside Entertainment Weekly (Thanks, Fipi Lele!)