Local data storage & security (Android App)

[alexb]

Dear All,

just switched from that other end-to-end encryption tool to Cryptomator…coming along nicely!

Now I wonder about the following in the Android App (Samsung Galaxy S20FE 5G with Android 13 and OneUi5.1):

Once I open a document (e.g., pdf) from the vault, it will be opened in e.g., Acrobat (or whatever app I select). Even though the vault is locked, I still can acess the file in Acrobat. But I don’t find the local storage to delete this file, and in case of sensitive documents, they would be kept on local storage, right?

So my question: where does the Cryptomator app download files to, and is there a way to delete the download or lock the access directly from the app?

Note: in some older thread I found a local path for local Cryptomator storage in android, but in root\android\data there’s no folder…

Looking forward to your hints,

Cheers, Alex

[SailReal]

Hey and welcome to the Cryptomator Community ,

Firstly I would recommend the following post to read:

No Google Play. Syncthing + sdcard = secure?

That’s an interesting question. Let me explain a bit: If you open a file using Cryptomator for Android with an external app like Keepass, we share a link to a temporary copy of this file using a ContentProvider with the selected app. Before we share the link, we downloaded, decrypted and saved this file as temporary file to the internal storage of Cryptomator for Android on which only Cryptomator for Android have access to (internal storage is part of Android’s sand-boxing model). After that,…

Regarding the question

@alexb

Once I open a document (e.g., pdf) from the vault, it will be opened in e.g., Acrobat (or whatever app I select). Even though the vault is locked, I still can acess the file in Acrobat. But I don’t find the local storage to delete this file, and in case of sensitive documents, they would be kept on local storage, right?

it means that Acrobat did create a copy of the file outside of Cryptomator’s control.

@alexb

So my question: where does the Cryptomator app download files to, and is there a way to delete the download or lock the access directly from the app?

If your phone is rooted you can check the directory /data/user/0/org.cryptomator/cache/decrypted/ after locking the vault but as stated in the post above, this is only possible on rooted phones because otherwise the sandbox model of Android does not allow it for very good reason.

[6c85jz24-brg68s51g-f]

Please describe the clean-up process on a non-rooted Android phone running 1.10.0 should the vault be closed after the document is opened & the phone should kernel panic. I am looking to confirm there will be no potential leaks from a spontaneous reboot/power cycle.