Save .tox profile and chat .db file to application directory on internal memory and implement import/export features

There are two kinds of .tox profiles:

  • not encrypted
  • encrypted with a password

And Android applications can store files in two places:

  • "application storage", which can only be accessed by the application that owns it.
  • "internal memory", which can be accessed by all applications with "storage" permssion.

"Application storage" is much better for security, because other applications won't be able to read the files not belonging to them.

Why not store .tox profiles in "application storage" then? The problem is that the user can't access files in "application storage". Only the app can do that. An app that respects its users must implement import/export for files in application storage. Another problem is that if you delete the app or tap "clear cache", all files in "application storage" are deleted without warning. It's easy to accidentally lose your .tox profile this way.

Were it not for these Android shortcomings, I would have used "application storage" for everything. But because of this shortcomings, Protox currently stores .tox profiles in "internal memory".

But it means that if the .tox profile is not encrypted, then any other app with "storage" permission can read the .tox profile and steal your Tox account.

To resolve this problem, I am going to add support for storing profiles in "application storage" and provide the user a choice between storing any profile in "internal memory" or "application storage", and let the user freely move profiles between the two places.

I am going to display a warning advising against storing unencrypted profiles in "internal memory", because they can be stolen by any application with "storage" permission.

Edited by Nikolay Borodin