nik/bitchat-android
1
0
Fork 0
mirror of https://github.com/permissionlesstech/bitchat-android.git synced 2026-09-19 04:59:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

Keep app-private data out of backup and device transfer

Browse Source 
The extraction rules excluded exactly two SharedPreferences files, and
one of them is no longer written: EncryptionService moved its key store
from "bitchat_crypto" to "bitchat_crypto_secure". Because these lists are
allow-by-default, everything not named is eligible — which is the live
key store, SecureIdentityStateManager's "bitchat_identity", the geohash
alias and conversation registries, and private_conversations.db, the
whole private message history.

android:allowBackup="false" covers cloud backup. It does not settle
device-to-device migration: for apps targeting Android 12 or higher the
platform documents that D2D transfer cannot be disabled on some
manufacturers' devices, so the <device-transfer> section is the only
thing between a phone migration and a copy of the identity keys and
every private message.

Make both files deny-by-default across every storage domain instead of
naming individual files. A name-based list has to be updated every time
storage is renamed or added, and this one already wasn't.
This commit is contained in:
Taksh 2026-08-16 08:08:30 +05:30
parent 5156f7de89
commit 90d6eedc90
2 changed files with 49 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
app/src/main/res/xml/backup_rules.xml
View File

@ -1,5 +1,20 @@
<?xml version="1.0" encoding="utf-8"?>
<!--
Auto Backup rules for API 30 and below. android:allowBackup="false" already disables backup
on these releases, so this file is a second line of defence rather than the primary one — but
it must not disagree with data_extraction_rules.xml about what is sensitive.
Deny-by-default for the same reason: the previous list named "bitchat_crypto.xml", which
EncryptionService stopped using when it moved to "bitchat_crypto_secure".
-->
<full-backup-content>
<exclude domain="sharedpref" path="bitchat_prefs.xml"/>
<exclude domain="sharedpref" path="bitchat_crypto.xml"/>
<exclude domain="root" path="." />
<exclude domain="file" path="." />
<exclude domain="database" path="." />
<exclude domain="sharedpref" path="." />
<exclude domain="external" path="." />
<exclude domain="device_root" path="." />
<exclude domain="device_file" path="." />
<exclude domain="device_database" path="." />
<exclude domain="device_sharedpref" path="." />
</full-backup-content>

36
app/src/main/res/xml/data_extraction_rules.xml
View File

@ -1,11 +1,39 @@
<?xml version="1.0" encoding="utf-8"?>
<!--
None of bitchat's app-private storage may leave the device.
These rules are deny-by-default on purpose. An allow-by-default list that names individual
files goes stale the moment storage is renamed or added, which is how "bitchat_crypto.xml"
came to be excluded here after EncryptionService had already moved to
"bitchat_crypto_secure", leaving the live key store, "bitchat_identity", and
"private_conversations.db" eligible.
android:allowBackup="false" covers cloud backup, but for apps targeting Android 12 (API 31)
or higher the platform documents that device-to-device migration cannot be disabled on some
manufacturers' devices, so <device-transfer> is the only thing between a phone migration and
a copy of the identity keys and every private message.
-->
<data-extraction-rules>
<cloud-backup>
<exclude domain="sharedpref" path="bitchat_prefs.xml"/>
<exclude domain="sharedpref" path="bitchat_crypto.xml"/>
<exclude domain="root" path="." />
<exclude domain="file" path="." />
<exclude domain="database" path="." />
<exclude domain="sharedpref" path="." />
<exclude domain="external" path="." />
<exclude domain="device_root" path="." />
<exclude domain="device_file" path="." />
<exclude domain="device_database" path="." />
<exclude domain="device_sharedpref" path="." />
</cloud-backup>
<device-transfer>
<exclude domain="sharedpref" path="bitchat_prefs.xml"/>
<exclude domain="sharedpref" path="bitchat_crypto.xml"/>
<exclude domain="root" path="." />
<exclude domain="file" path="." />
<exclude domain="database" path="." />
<exclude domain="sharedpref" path="." />
<exclude domain="external" path="." />
<exclude domain="device_root" path="." />
<exclude domain="device_file" path="." />
<exclude domain="device_database" path="." />
<exclude domain="device_sharedpref" path="." />
</device-transfer>
</data-extraction-rules>