39aldo39 / libdecsync-android Goto Github PK

Currently the library requires storage access. Any application with storage permission on Android can read any DecSync path. For example, RSS reader only requires access to articles, feeds and categories paths, but not resources, where the contacts are stored. Therefore, it should not have access to it.

Currently, Android does not have fine-grained storage permissions. Instead, it is possible to build a "keyring" application, similar to https://www.openkeychain.org/, which has storage access, and make all end-user apps, such as RSS reader and Contacts synchronizer (DecSyncCC) access the application API instead of the storage directly.

Then the keyring application can evolve to encrypt the storage without any changes required to the end-user apps. The UI to request passwords and manage key storage keys will have to be built only once.

See related issue 39aldo39/DecSync#3