To my knowledge, all current Android apps with internet permission enabled are prone to apps stealing data. For example, if you have a messaging app, all your messages are readable by the company which provides the app and in turn, whoever can hack/bribe the company. The company could use end-to-end encryption, but that's not verifiable unless the app is open source. Even if it is, every app release has to be audited separately which is not realistic.

Is there a way(3rd party or native), or any plans to implement secure data exchange for Android?

The way I'd expect it to work is either by using a specific permission which would only allow data encrypted by the OS to be sent over the network or some kind of state-sharing via file-system + 3rd party app doing the encryption and sharing only.

  • Comparing the binary and source of an (Java based) open source app is not that problematic on Android as the built environment does not have so much variants (like on C/C++). I think even automated comparisons should be possible. Hence only the diffs between the releases would have to be audited. – Robert Sep 3 '18 at 14:35
  • Thanks for the input. I don't think continuous audits are a viable option even if only diffs are audited. It's manual labor of high expertise which is extremely expensive and even error prone. – Tomas Sep 3 '18 at 19:22

The closest you'd get to such a thing is a VPN. The VPN provider can apply any encryption you like to the data. You could even set up a VPN server with a built-in IP address filter (like an adblock system), which doesn't allow the app to talk to its developer's servers.

That all sounds good, but that wouldn't stop Facebook reading your WhatsApp messages. Most messaging apps are designed to communicate via their own servers, instead of directly from your phone to your friend's. This is important for a couple of reasons:

  1. Most cellular providers block incoming connections from the Internet to a phone, possibly combined with NAT making several phones share a single IP address. Most Wi-Fi networks use NAT too. To pass messages back and forth, you need some fixed endpoint to connect to, and that's the server that runs the app.

  2. Servers are also used to store the uploaded messages and keep them in sync between all your devices (phone, tablet, web interface, and whatever else). They also allow offline messages, just like how voicemail is on the cellular provider's server, not on your phone.

So if you want your mainstream chat apps to work at all, you need them to talk to their servers. Your best alternative for just chat is an app where you can host your own server and be in charge of your own security. Jabber (aka XMPP) is one such chat system, and there are several open-source clients for Android. You can either verify that the client you like isn't talking to anything but your Jabber server, or put it behind a firewall that only lets it talk to that one server.

Self-hosting is the only trust-free option for other similar services, such as email or cloud storage.

  • To be clear, I'm not looking for a chat app. I'm investigating the problem in Android design/ecosystem and am thinking about possible solutions. A chat app is just an example of a use case where I would want to share data between multiple devices, have an app be closed-source and be confident that the app is not able to send any of my unencrypted data to it's servers. I don't think a VPN would be of any use in this case since if I don't allow the app to pass unencrypted data to it's servers, the app won't work properly. – Tomas Sep 3 '18 at 19:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.