Does encryption, factory reset, encryption make a safer used phone? I recently purchased a used Moto X. I know the person I bought it from so I'm not terribly worried but here is my idea to shore up the security on a used device.


Don't put in your SIM card or log into any accounts
Factory reset
Encrypt device
Factory reset
Encrypt device
Install SIM, log into accounts
Enjoy


This seems like a solid way to make sure the device is completely wiped out... except for the boot loader. I'm not sure how the comes into play, or if this method even makes that big of a difference. The process I outlined isn't difficult, it just takes a few hours.


Is it worth it?
Can it be improved?
What about the boot loader?
Factory-resetting twice is pointless. The first factory reset will already wipe all user data: the second won't delete anything that wasn't already deleted by the first. Encrypting the device is also a waste of time, because you've already factory-reset the device.

It might make some sense if you were the seller of the phone, and you wanted to overwrite the internal storage several times to make sure the buyer couldn't recover your data, but that's the opposite of what you want. A single factory reset will delete all the user data, giving you a clean slate.

If you're worried about the previous owner having left a backdoor in the OS, then ensure the bootloader is locked and flash the stock ROM yourself. This way you're sure to have a clean OS.

If you suspect the buyer has enough skill to backdoor the bootloader so that it will also make changes to the new OS as you flash it, and also disable signature verification so that it will still boot but looks like the bootloader is locked, then just don't buy a phone from them. If you think they're that good, and that desperate to get hold of your data, then they'll find a way around whatever you do. You just can't trust the device at all in that case.