MuntashirAkon / MuntashirAkon/AppManager

Remove OpenKeychain, import/export/create OpenPGP keys within App Manager

Open
#451 0 comments 0 reactions 0 assignees View on GitHub
Feature Priority: 4 Security Status: Accepted
Dominant language
Java
Stars
9k
Forks
518
PR merge metrics
No merged PRs in 30d

Description

Due to security issues discussed in #366, we, unfortunately, have to end support for OpenKeychain as the API it provides cannot be used to encrypt/decrypt backups without writing the unencrypted backups in the persistent storage at first. Instead, the user of OpenKeychain should be able to import their keys in App Manager. The KeyStore management in App Manager should be very secured. I'm also considering separating it from App Manager so that users can manage all their keys using it rather than just backup and signing keys, along with an API which can be used to encrypt/decrypt streams without storing them to the persistent storage. Separating KeyStore manager would also make it more secure as vulnerabilities in other part of App Manager may affect the KeyStore manager.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.