Re:A list of all Android permissions
by digi_owl on Monday October 03, 2016 @07:07AM
(#12626471)
That was about whatsapp doing a major goof and putting private files in a "public" area (every app already had a private area for file storage) and failing to secure them properly (encryption is hard, apparently).
[ Parent
| on HN ]
WhatsApp messed it up particularly bad, but it's not the only example. The point is that there was no private access to the SD card. If you had large files that did not fit on the internal storage, using the shared external storage was the only alternative. Developers abused that and ended up putting all sorts of private data on the SD card.
Lets try to not confuse "external storage" (effectively a partition on the emmc, but mounted under /sdcard for legacy reasons) and an actual SD card.
Removable storage, SD, USB, etc, was moved from external_storage to media_storage with Android 3.1.
Note that external_storage was still about putting files in an area readable by any and all apps that had read_external_storage permission.
In other words, the change would do jack all to safeguard against idiots like the whatsapp app devs.
> The point is that there was no private access to the SD card.
Sure there was! Simply generate a random key, store it in the (small) private storage area, and use it to encrypt whatever you want to write. Instant private area!