Start with the why:
It is safe to say that /e/ users are somewhat sensitive to privacy and security aspects. Therefore, the tagline “my data is my data” should also apply from a physical perspective.
Use case rough:
Sadly, it is probable that one loses its device or the device gets stolen. Surely, storage is encrypted, and one can add a relatively secure PIN, but there should still be the possibility to wipe the device → peace of mind.
- User enrols his device - voluntary
- Trigger: User loses its device
- User can login to /e/ web interface
- User can hit a wipe remotely button - should need to confirm
- Bonus: User gets confirmation if the device has acknowledged the command
Some assumptions and remarks:
I think the implementation could be pretty basic → peace of mind
Android seems to support a remote wiping feature since version 2.2 - questionable, if still around? Google Find My Device?
Generate or use a device-specific signature - trust
Build enrolment backend service, which is associated with /e/ user account
Maybe a simple native app for enrolment and periodically listening/requesting for a wipe request
Enhance the current /e/ web app with a management view or build a dedicated web app accessible via /e/ web interface - it probably depends a bit on how loose or tight this is coupled with Nextcloud.
I would assume that the request is triggered via mobile data connection but could also be done via SMS but would then require mobile number registration with /e/ and may also be less secure