Revoking Access

Not long ago, after a tir­ing busi­ness trip, I left my knit­ting bag with my Nex­us 7″ tab­let on the plane. I real­ised it was gone before my con­nect­ing flight left, and thanks to some help­ful United Air­lines people, got it back in time to make that flight home. I did have a few pan­icked minutes though, won­der­ing where it was, wheth­er someone had it, and what to do about the data on it. Since then I’ve imple­men­ted more secur­ity meas­ures, espe­cially when travelling.

Of course, the first thing to do is make sure there’s a PIN or pat­tern or oth­er lock on the screen. I don’t usu­ally both­er with this at home, but when I travel I do.

Top of my list for the sec­ond­ary lay­er, after the pass­word for the entire device, are passcodes for both Drop­box and Ever­note; I keep per­son­al inform­a­tion in one and cli­ent inform­a­tion in the oth­er. You can unlink a giv­en device from Drop­box and revoke access to Ever­note from anoth­er machine, but that won’t neces­sar­ily stop someone read­ing the inform­a­tion already on the device. Secur­ity or passcodes solve the idle curi­os­ity prob­lem, at least to some extent (this is a premi­um, i.e. pay-for fea­ture on Ever­note). Drop­box also gives you the option of two-factor authen­tic­a­tion, and of course you can encrypt the files that you store.

For actu­al pass­words and smal­ler items of inform­a­tion, I use LinkeSoft Secret!, although I may move away from it since it does­n’t sync the Android pass­word store to the Mac. I’m para­noid enough that I don’t do online bank­ing on my phone or tab­let; I have my bank’s app on my phone but only to find the nearest loc­a­tion of a cash machine or branch.

I already have a PIN required for any­one to buy an app on the device; this also stops my daugh­ter buy­ing games or in-app pur­chases. (In the Google PlayStore, under Set­tings, it’s the ‘Use pass­word to restrict pur­chases’ setting.)

I have Lookout installed, which has options to find your phone, then lock it, and even remotely wipe your phone’s data; for­tu­nately I did­n’t need to try it out but there is a cer­tain peace of mind in know­ing that nuc­le­ar option is available.

What all of these apps have in com­mon is the assump­tion that you may have more than one device run­ning Android, which is more than I can say for Google accounts. If you go into your account set­tings, secur­ity, man­age access, you are con­fron­ted with some­thing that looks like this: 

Google access to sites and apps

which does­n’t give me any clues as to which of the many ‘revoke access’ but­tons I should push to revoke access to a spe­cif­ic device. Surely Google could have figured out that some people might have more than one Android device, or more than one applic­a­tion or web site want­ing access?