I don’t have Google apps on in of my devices. The other one has MicroG. I love that I can buy a license direct form Cryptomator.
Just one thing I’ve noticed about Android 10 and 11:
permission to access the sdcard is all or nothing. Thus, to grant cryptomator and syncthing sdcard access, that would be mixing with any app that wants to read/wrote to the sdcard.
Would cryptomatorprotect against this cross sdcard security issue?
The answer to this question highly depend on the security issue you referring to. In general, scoped-storage was introduced to Android in order to be able to granularly determine which folders, for example, the torch app is allowed to access. The main aim is to prevent this app from analyzing data, for example, without any benefit for the user or without the user being aware of it.
Cryptomator acquires this permission, for example, for the auto image upload. If an image file is stored somewhere, this image can be captured and uploaded. Cryptomator only saves files to the SD card if they are explicitly exported and the SD card is selected as destination. Otherwise, no data will get into the SD card that could be used by other apps that have also been granted this permission.
If you don’t trust Cryptomator itself, and since your vault is in the local storage from Cryptomator’s point of view, you can revoke the internet permission of the Cryptomator app so that even if Cryptomator would do something with your data, it would not be able to send the results.
Also, the app is open source, so another option would be to study the source code: GitHub - cryptomator/android: Cryptomator for Android
All files encrypted with Cryptomator are protected against these apps. In case the vault is on the SD card or the internal storage of the phone and these apps also have the storage permission, they could access the encrypted data and could try to decrypt files, but I wish those apps a lot of fun with that …as long as you have used a good password, it currently lasts for decades to “forever”, not to mention the electricity that would be required…
I appreciate your help. This is sounding better. I thought Cryptomator was just for keeping things private in the cloud. To be able to keep things private between apps as well would be fantastic. Seeing that data is encrypted at rest is great too.
One thing I don’t understand though:
How does Cryptomator give access access to the unencrypted data to one app but not another?
For example: How does Cryptomator pass the unencrypted data to a folder based app like ObsidianMD without allowing other apps access to those files?
Putting it another way:
Sorry to ask the same question so many times but I have to be sure before I buy and recommend it as a solution for ObsidianMD and similar apps.
That’s an interesting question. Let me explain a bit:
If you open a file using Cryptomator for Android with an external app like Keepass, we share a link to a temporary copy of this file using a ContentProvider with the selected app. Before we share the link, we downloaded, decrypted and saved this file as temporary file to the internal storage of Cryptomator for Android on which only Cryptomator for Android have access to (internal storage is part of Android’s sand-boxing model). After that, as already mentioned, we share the link to this file using the content provider to the user selected app and only to this app.
As soon as we return to Cryptomator, we revoke the permission of the external app to access the file. If the vault has not been locked in the meantime, we check whether the file has been changed. If so, we publish these changes back to the cloud.
As soon as possible we delete the temporary file in the internal storage and also revoke the permission of the external app to access the file when the vault gets locked.
Side note: What the external app does with the contents of the file while the app has access to it is beyond our control. You should only open files in apps you trust - but that should be obvious.
Scoped storage performs many extra permission checks for every single file access, causing significant performance degradation when opening and using Obsidian.
Scoped storage does not provide a way to watch for external changes, which is critical when using Obsidian with a third-party synchronization tool.
> In Android 10 apps have a limited raw view of the filesystem, with no direct access to paths like /sdcard/DCIM. However, apps retain full raw access to their package-specific paths, as returned by any applicable methods, such as Context.getExternalFilesDir.
However my current recommendation would be to not keep sensitive data in Obsidian but use other tools for that (such as Bitwarden) and also be judicious in which apps you install.
so mostly other solution providers also suck in this way.
Not true. Most other cloud storage providers implement this feature flawlessly. IceDrive, OneDrive, Dropbox, etc, etc, all implement a document provider so you can access the files and directories from other Apps and/or the OS.
Sadly, this software is useless because the Crypromator team has repeatedly promised, delayed, and failed to prioritize this essential feature for many years, and worse their recent posts suggests that their software architecture requires an major overhaul in order to implement it . Moreover they do not provide full transparency by not providing a trial or full disclosure up front. So people have to find out the hard way (by paying for it and/or stumbling on posts like this one) that the Android app doesn’t work like the desktop version.