Upcoming android security feature

[arianwen27]

Heyo, been reading the change log for google play system updates and April has a very interesting feature.

It's listed as "Enables a future optional security feature, which will automatically restart your device if locked for 3 consecutive days."

Meaning if you don't touch your phone for 3 days, it'll auto reboot. Now, this feature isn't out yet, this update adds the code for it, but it cannot be enabled yet.

Why is this useful? 

Android devices have 2 security modes. BFU and AFU. 

In Before First Unlock, your data is encrypted and fully secured. This happens after a reboot or shutdown, before you enter your code, the phone is in the most secure state from attacks. In the event someone has the device and tries to extract data, if the phone can't read it's own data, attackers will find it very hard to. Should also say, this mode secures things so far that if a contact calls you, the phone is unable to see they are a contact in your phone. All data except the bear minimum to show the lock screen is encrypted. Saying as it's impractical for a phone to always be in this state, as you wouldn't be able to get notification or phone calls.

In After First Unlock, the phone has had it's Unlock code entered. Meaning the phone has the key to decrypt it's own data and operate as normal. Your phone will be in this state after the screen code has been entered and the device not rebooted. Since the phone can unlock and read the data within it, the possibility of a physical attacker extracting data is higher. There are still many protection systems to prevent attacks, but it won't be as strong as if the phone itself can't access its own data.

No number of exploits can extract the unlock key from a phone that itself does not know the key.

If someone steals a phone or it is taken, decent chance it will be in AFU as people tend to use their phones if they are carrying them. This means attackers have to break the weaker security mode. If the phone auto reboots after 3 days, it means attackers have 3 days to try and get into the device, then it reboots into BFU mode, making attacks much harder.

As of right now, samsung phones have a similar feature. In device care, you can allow the device to self reboot if performance issues are detected. You can also set times for the device to self reboot. I believe it only triggers if the device isn't being used and has no sim lock. I use a sim lock so I've never had it work.

As of IOS 18, all iphones will self reboot after a few days as well. So this google play system update allows android users to match that level of security.

[Piper123]

Really useful post

I read something about this a day or two back but was out at the time and forgot to go back and find it. 😊

[JAMES4578]

yes certainly a great post detailing the security modes

The self Reboot  if locked for three consecutive days is a positive development.

one article here https://9to5google.com/2025/04/16/android-auto-restart-security/