Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
1) Assuming I have an untrusted app, e.g. sideloaded from an untrusted source with permissions to access storage granted installed on a recent (v7 or 8.x) Android device.
2) Assume I also have Signal, Wire or Telegram etc. installed from the Google Play app store on the same device.
Could the untrusted app access either the stored messages, or the screen contents and keypresses when in the secure messaging app? Or is there some other method of compromising the supposedly secure messages?
As Google documentation (https://developer.android.com/guide/topics/data/data-storage) says:
By default, files saved to the internal storage are private to your app, and other apps cannot access them (nor can the user, unless they have root access). This makes internal storage a good place for internal app data that the user doesn't need to directly access. The system provides a private directory on the file system for each app where you can organize any files your app needs.
When the user uninstalls your app, the files saved on the internal storage are removed. Because of this behavior, you should not use internal storage to save anything the user expects to persist independenly of your app. For example, if your app allows users to capture photos, the user would expect that they can access those photos even after they uninstall your app. So you should instead save those types of files to the public external storage.
