Updates, Lock Screen & Encryption

An Android security patch is a vendor fix for a hole that is already public. Attackers read the same bulletin you ignore. "I don't have time" is not neutrality — it is volunteering to stay in the easy set: drive-by kits, malicious ads, and wormable flaws that mass-scan last quarter's builds. Settings → System → System update (wording varies by OEM) is the monthly habit. Reboot when asked. A downloaded patch that never reboots is a file on disk, not a closed door. Three update planes matter, and people collapse them into one button. (1) The Android OS / vendor security patch level — the date on Settings → About phone. (2) Google Play system updates — a quieter channel that patches core components even when the OEM is slow to ship a full firmware bump. (3) App updates from Play — browsers, bank apps, messengers, WebView. Play Protect scans are useful; they are not a substitute for installing the fix. Enable automatic app updates for software you already trust. Do not install "update APKs" from SMS, Telegram, or a fake overlay — that is Module 1's dropper wearing this lesson's vocabulary.

Emergency out-of-band patches exist when a bug is already being exploited in the wild. Those are the weeks you do not wait for Wi-Fi at home "this weekend." Official channels only: the Settings update tile, Play Store, or the OEM's own support page you typed — never an email that says "tap here to patch." If a bank or work MDM requires a minimum patch level, that is not theater; Integrity and enterprise policy are reading the same date you can see in About phone. Skipping updates to "keep a tweak" is how custom setups from Module 2's rooting lesson become unpatched daily drivers.

A lock screen is not decoration. On modern Android it is the key that unwraps device encryption keys when you authenticate. Swipe-to-unlock, no lock, or 1234 / 0000 / 1111 / year-of-birth is an open vault with a polite sign. Use a PIN of at least six digits that is not a date, a pattern that is not a letter Z, or better a passphrase. Biometrics (fingerprint, face) are convenience on top of that secret — they are not a reason to weaken the fallback PIN. If someone forces the biometric, you still needed a strong PIN for the next boot and for encryption at rest. Auto-lock quickly. A five-minute timeout is a gift to shoulder-surfers and grab-and-run. Seconds, not minutes, for a phone that holds mail, banking, and authenticator apps. Hide sensitive notification content on the lock screen: OTPs, bank alerts, message previews. Module 2 already taught that notification access can steal codes; the lock screen is the analog version — anyone standing over the table can read the SMS. Smart Lock / "trusted places" that keep the phone unlocked at home are convenience that becomes a theft problem the moment a guest or a burglary is in that place. Prefer unlocking on purpose.

USB and lock-screen settings deserve a glance: do not leave the device unlocked while charging in a public port; prefer your own cable and a lock that holds when the screen is off. Developer options and OEM unlock toggles are not "performance." They are how Module 2's bootloader story starts. For a daily driver you bank on, keep the lock boring and strong. You are not designing a movie unlock. You are making opportunistic theft and casual spyware-install-while-you-were-in-the-bathroom expensive.

Modern Android uses file-based encryption. After a reboot, data stays wrapped until a secure lock screen credential is entered. That is the mechanism behind "a strong lock protects data if the phone is lost." No lock, or a trivial PIN, means the cryptographic story is weaker in practice: a thief with the hardware has an easier day, and so does anyone who picks the phone up unlocked. Setting a secure screen lock is how you turn default encryption into a control you can point at — not a slogan in a spec sheet. Find My Device (Google's locate / remote lock / remote erase for Android) must be enabled before the loss, on YOUR phone, signed into YOUR Google account, with that account itself unique-passworded and MFA'd from Topics 4 and 5. After a loss you use android.com/find or the Find Hub from a browser or another device you own — lock it, locate it if you still have a realistic chance of recovery in a place you can safely go, erase it if the phone is gone and the data would hurt. That erase is for a device you own. It is not a tool to wipe a partner's phone, a classmate's handset, or "the stalker's" anything. Locate is not a hunting license. If the situation is an abusive relationship or stolen-identity crime, you use official account recovery and local safety resources — you do not run a find-the-person op from this app.

OEM update lag is a real risk, especially on budget and "unofficial" models: the silicon vendor and the brand may ship patches months late, or stop entirely while the phone is still your daily driver. That lag does not make "skip everything" rational. You still install Play system updates, browser and WebView updates, bank-app updates, and Play Protect scans. You still set the lock and encryption. You still enable Find My Device on your account. If About phone shows a security patch older than your comfort and the OEM has abandoned the model, plan a replacement — that is risk management, not shopping advice as a flex. Unsupported phones accumulate known holes. Patch what you can until you can leave.

This is a notes lab on a phone or computer you own. You will not run exploits against unpatched devices. You will not test Find My Device on anyone else's handset. You will not factory-reset a device you do not own. Open Settings on YOUR Android and copy facts into a file: patch date, Play system update status, lock type (not the PIN itself), Find My Device on or off. chmod 600 so the sheet is not world-readable on a shared box. If you have never lost a phone, you still want the sheet — encryption and remote lock that start after the bag is gone are too late.

mkdir -p "$HOME/cyberlium-lab"
NOTES="$HOME/cyberlium-lab/android-hygiene.txt"

{
  echo "android hygiene — MY phone and MY Google account only"
  echo "date: $(date -Iseconds 2>/dev/null || date)"
  echo ""
  echo "UPDATES (Settings → System update / About phone):"
  echo "  android_security_patch_date:"
  echo "  play_system_update_checked: yes/no"
  echo "  auto_app_updates_from_play: yes/no"
  echo "  I will reboot when a patch is waiting — a download is not applied until then"
  echo "  I will NOT install update APKs from SMS, chat, or random sites"
  echo ""
  echo "LOCK SCREEN (do not write the actual PIN/passphrase in this file):"
  echo "  secure_lock_set: PIN_6plus / passphrase / pattern_not_trivial / NONE_FIX_NOW"
  echo "  not_1234_0000_birthday: yes/no"
  echo "  auto_lock_seconds_not_minutes: yes/no"
  echo "  lock_screen_hides_sensitive_notifications: yes/no"
  echo "  biometrics_are_convenience_on_top_of_strong_fallback: yes/no"
  echo ""
  echo "ENCRYPTION:"
  echo "  I understand modern Android encryption is tied to a secure lock"
  echo "  swipe_or_no_lock_means_weak_at_rest_protection: yes I get it"
  echo ""
  echo "FIND MY DEVICE (android.com/find) — MY Google account:"
  echo "  enabled_on_this_phone: yes/no"
  echo "  google_account_has_unique_password_and_MFA: yes/no/working_on_it"
  echo "  I will use locate/lock/erase ONLY for a device I own"
  echo ""
  echo "OEM LAG:"
  echo "  vendor_still_shipping_patches: yes/no/unsure"
  echo "  I still patch Play system + apps + browser even if firmware is late"
  echo ""
  echo "ETHICS:"
  echo "No remote wipe of someone else's phone. No locate-to-hunt a person."
  echo "No hack-back. Factory reset (next lessons) is for a device I own."
} > "$NOTES"
chmod 600 "$NOTES"
ls -l "$NOTES"

You now treat patches, a real lock screen, encryption-at-rest, and Find My Device as one stack: close known holes, wrap the disk with a credential that is not 1234, hide OTPs on the table, and prepare remote lock for a device you own — even when the OEM is slow. Next — What to Do If Your Phone Is Infected — you will use a 15-minute-plus order: stop banking on the dirty handset, revoke sessions from a clean device, remove mystery admin/Accessibility, reset a phone you own if it persists, then Topic 4/5 passwords and MFA. Shame is delay. Revenge and someone else's wipe are still out of scope.