0

i'm newbie of android.My goal is this: i have to enable different apps to share primitive data securely.

App 1 retrieves data for remote resources and save it (it's the data owner). App 2, App 3, ... have to be able to retrieve the data stored by App 1.

How to share this data securely? It's important for me avoid foreign apps installed on the device to retrieve this data.

Thanks in advance

user2703633
  • 29
  • 2

1 Answers1

1

When applications share the same user id and are signed by the same entity, the can shared data. Then you just use the regular internal shared storage.

In the manifest, set the shared user id:

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
          package="string"
          android:sharedUserId="string"
          android:sharedUserLabel="string resource" 
          android:versionCode="integer"
          android:versionName="string"
          android:installLocation=["auto" | "internalOnly" | "preferExternal"] >
    . . .
</manifest>

http://developer.android.com/guide/topics/manifest/manifest-element.html#uid

The internal storage example is:

String FILENAME = "hello_file";
String string = "hello world!";

FileOutputStream fos = openFileOutput(FILENAME, Context.MODE_PRIVATE);
fos.write(string.getBytes());
fos.close();

http://developer.android.com/guide/topics/data/data-storage.html#filesInternal

EDIT I don't know why having access to all the data is a bad thing. You DO own the apps so you control what they do. If you really want to limit the data that is shared, use a ContentProvider with Permissions that limit access or at least let the user decide who access it, AND encrypt the data. Alternatives: Store this data on a remote server and let each application sync that data into its own secure private storage.

How to restrict content provider data across applications

Community
  • 1
  • 1
Spidy
  • 39,723
  • 15
  • 65
  • 83
  • Thanks Spidy for your response. But signing apps with the same user id means that they can share all data, is it right? What about if i have to share only some data (for example the user identifier) and protect others? I'm thinking about this alternative solution: saving primitive data in sharedPreferences file in mode WORD_READABLE cripting them and putting the decritping key in the api shared by the apps. In this way data can be accessed but decrypted only by my apps. – user2703633 Feb 12 '14 at 13:38
  • That DOES complicate matters. WORLD_READABLE is deprecated as of API-17 and is considered very unsafe (http://developer.android.com/reference/android/content/Context.html#MODE_WORLD_READABLE). You could do something similar with a ContentProvider. As long as the data is encrypted, you should be fine. – Spidy Feb 12 '14 at 18:43
  • Great. I'm going to try your suggestion about ContentProvider, it seems the right solution for me. Very appreciated help. – user2703633 Feb 13 '14 at 08:28