Samsung's Maintenance Mode aims to hide your private information from repair techs

Shawn Knight

Posts: 15,294   +192
Staff member
In brief: Samsung is now rolling out a new privacy-minded feature on select Galaxy devices following a successful pilot program earlier this year. Maintenance Mode is designed to ease anxiety when handing over your device for repairs. With it, users can block access to sensitive information including photos, contacts or messages.

To enter Maintenance Mode, simply visit the battery and device care menu under settings to activate it then reboot your phone. The mode essentially creates a separate account that gives the user (in this case, the repair tech working on your phone) access to core operating functions while restricting access to personal information.

When the owner reclaims the device and exits Maintenance Mode, all apps and data generated while in that mode will be automatically deleted.

Reports of repair techs lifting photos from customers' phones are not all that uncommon. Incident would likely go undiscovered but occasionally, the offender incriminates themselves by posting pictures online, sharing them with friends or even sending them directly to the person they belong to.

Seungwon Shin, VP and head of mobile security at Samsung, correctly highlights that most users have their whole lives on their phones including credit card information and personal family photos. Shin said the new feature is yet another way to make customers feel safe and in control so they can continue to explore new mobile experiences.

Maintenance Mode was trialed on the Galaxy S21 in Korea back in July and debuted in China in September. It is now rolling out globally on select devices running One UI 5, although Samsung said availability will vary by market, device model and network provider. The rollout is expected to continue throughout 2023.

Samsung encourages users to back up any personal or mission critical data before activating Maintenance Mode. Those dealing with super sensitive data might want to delete it from their phone entirely before handing it over to a third party. Better yet, do not even store it on your phone to begin with.

Image credit: Tima Miroshnichenko

Permalink to story.

 
I would love to have a Samsung phone, but between the bloatware and locked bootloader, I will never buy one.
 
I would love to have a Samsung phone, but between the bloatware and locked bootloader, I will never buy one.
I'd buy one if they gave us those sweet sweet 7000 mah phones they sell in other markets. Or if they brought removable batteries back. As it stands I'll ha e to stick to cheap motos until someone unstick their head form their arse.
 
I work at a phone repair shop and there's really no reason to have the phone unlocked.
In fact we tell customers to lock it prior to the repair, since most functions can be tested just fine even while locked (screen, touch, charging, battery, etc), including the sound by calling the phone. Virtually every locked phone can receive an incoming call without having to unlock it.
Also, there are several security apps in the PlayStore which can be used to lock all personal info but not the entire phone which works on all phones, no need to wait for Samsung to include it.
 
Now give back the guest account. No idea why that was removed; the guest account feature is an excellent one.
 
This mode is essentially nonsense if there is no end-to-end encryption with a key flashed into a special chip (it should not be possible to pull it out from there, I.e. you just need to make regular backups to your local drives without encryption, but the phone is always encrypted with a hardware key generated in it).

The smartphone may break so that you cannot get into the menu, but you still have to give it to the service man if you want a warranty repair or for a fee. The data should not be accessible to anyone other than the owner and everything on the flash should be stored in a crypto container. Something like in TrueCrypt (and the like) on a PC.

Even if the phone hardware fails (like as SSD/HDD), does not turn on - you do not need to worry about private data - they will not be available to anyone, even if the service engineer pulls out the flash image (or SSD/HDD read on special hardware service platform) through an external reader, bypassing the smartphone system (directly from the board).

In the place of ordinary people, I would be much more worried about solid (and intentional on the part of manufacturers) holes in network access from a smartphone for third-party software and OS components, drivers. On a PC, you can install a full-fledged firewall that, if you wish, completely blocks all network activity (if of course, you trust the firewall manufacturer or there are source codes, although of course code verification is a non-trivial level available to 0.0001% of the world's population at most). You can block access to anything on the PC. But on a smartphone, which is much more dangerous in terms of privacy (where even cameras and microphones do not have hardware independent shutdown if necessary), manufacturers intentionally left a hole in the form of uncontrolled access to the network from the applications and OS via wi-fi and partially via cellular internet. A sane person who thoroughly understands the level of risks will NEVER conduct any financial transactions on modern smartphones and store dangerous private data on them a priori. But these are sane people, and how many of them are there on the planet? 0.5-1%?

It is through such network holes from smartphones that data is collected from smartphones through installed applications (and some, according to their declared functionality, for example, a calculator, etc., do not even need access to the network, but they climb there anyway) and manufacturers through the OS and their system applications (which obviously do not even allow to be intentionally deleted, without tricks).

As a result, the creation of a secure smartphone firmware, from the point of view of privacy and financial transactions, turns out, in practice, into a non-trivial task, almost unsolvable for ordinary people.

Let me remind everyone that in the past there was a small company that created secure firmware for modified smartphones. Company did not conduct essentially any criminal activity within the framework of the law, but the US authorities nailed it because 90% of it clients were drug dealers and corrupts. It's like accusing a knife company that it's the knives that kill people, not the person with the knife in their hand. Let's ban all kitchen knives, which commit the bulk of domestic murder on the planet? Well, almost no one condemned the US authorities for this. Because it was profitable for them to suppress an independent company capable of making smartphones unopenable for special services. About the same thing happened to Zimermann a long time ago and his PGP. In the end, he apparently agreed with the authorities so that the persecution would not continue.

But now we are not talking about the level of accessibility for special goverment services (although even they do not have the right to get into private correspondence and data, which is ensured by strong encryption - and no court will help them, except as a direct violation of the law, because any Constitution provides the right not testify against yourself, I.e. a judge a priori cannot force you to hand over an access key without violating the constitution of any country, by the way, American judges have already violated the law several times by forcing the accused to hand over the keys, which they had no right to do under the Constitution, thereby violating the presumption of innocence in criminal law), but about the household level, just to hide your private data from unscrupulous people in service companies or if you throw your smartphone in the trash, if it burned down and there is no point in restoring it, and the data on the flash potentially remained.

This is ensured only by full encryption of all data at the hardware level, so that even through the from programmator and direct reading of the dump from flash chips, it was not possible to read private data and restore them without a private access key from owner. Namely, this is what is not provided in most smartphones.

Those. in reality, Samsung (like all other manufacturers, including Apple) only creates the appearance of real privacy, without providing it at an unrevealed hardware level (excluding only special services, but not private persons and business).
.
 
This mode is essentially nonsense
.

If I leave my phone for repair (battery swap, display replacement etc) there is a chance they might need a code. And yeah with giving a code your basicly handing out your phone including all the stuff installed on it.

I know alot of those places WILL look through your content if they have or get access. I used to work in a PC repair shop too, I had colleagues who had their spindles of CD'R's ready whenever someone from a webhosting service with their adult content came by for replacements.

Ive used to repair HDD's for some time but it never appeared into me to start looking through people their personal stuff. I guess thats what makes me different compared to the rest. At the end of the day you leave something very personal which is a mobile phone.

At least in my case I have 500+ chats stored in my device with over a 1000 contacts. Not so weird in my case.
 
Back