Secure document storage

hello-gos

What is the recommended way to store sensitive documents on a GrapheneOS phone?

c86

You can use a password protected / encrypted cloud storage app, or a password protected notes app without network access. Or put them in a password manager.

mmobder

hello-gos cryptomator with an encrypted backup to cloud?

horde

on your phone while having a long password.

bebop10

Cryptomator is a good way to encrypt documents

hello-gos

bebop10 Cryptomator is a good way to encrypt documents

Cryptomator looks great but cannot be used anonymously (credit card payment required).

Are there any similar alternatives? I don't need the cloud sync option.

kopolee11 You can also use a Private Space or a user profile with a unique password to store documents.

How does Private Space compare to using separate app like Cryptomator?

kopolee11

You can also use a Private Space or a user profile with a unique password to store documents. Each profile have their own encryption and lock method.

Novalissoide

hello-gos cannot be used anonymously

That is a one time payment which can be done on their website, no GPlay needed. The unlock code you then obtain will keep being valid. Use it to setup Cryptomator fully offline, you have the option to only sync to a local vault on the same phone. That vault could be manually saved to, e.g. a USB-stick, or backed up in any other way, and will keep its good encryption.

monozygote

Unless there are security concerns I find droidfs better.

It's free
Uses gocryptfs mode among others you can choose from. So 100% compatible with gocryptfs FUSE mounted volumes on Linux/MacOS.
Don't have to drag documents in/out of it. It presents itself as a document-provider so all apps can access your plaintext content using system file picker - pretty safe.
All this means works excellently with p2p sync like Syncthing.

Eg. You only sync the root of your encrypted dir eg. Documents/my-secret-stuff across all devices - Syncthing never sees your plaintext content. On Android droidfs uses SAF to give you the document provider access once you unlock (password/biometrics). On Linux use gocryptfs to FUSE mount the encrypted dir - same password.

If the encrypted dir is updated in the background, the mounted plain text dir immediately shows changes on all systems. It's file based encryption (not volume/block device based) so you are only sync-ing files that have changed.

Only disadv is that although droidfs has active-ish development on GitHub, they haven't published a release for sometime not sure why.

hello-gos

monozygote this app looks good but concerning to not have any updates for 18 months for a security related app.

Do you know pros and cons of using an app like that vs storing files in the private space when not using cloud sync?

monozygote

SAF/Document-Provider absence my main gripe with crptomator (and on top of that it's not free if we are splitting hairs).

https://www.reddit.com/r/Cryptomator/comments/1lj1lut/many_many_years_later_still_no_document_provider/

https://github.com/cryptomator/android/issues/35 (since 2017! )

etc etc

chinook

monozygote same. Looks best for me but I won't touch it until they fix it. At this point it's a bug to fix, not a feature to add.

Also thanks for that Reddit link. Looks like Round-Sync with rclone will fit the bill for me.

monozygote

hello-gos With my limited understanding, if you don't want to sync with other systems, keeping those docs in private space (or another profile) is better in every way - you are also not reliant on 3rd party softwares (see the drama with "Syncthing-Fork" recently).

But I have to sync and my laptop/phone is sometimes used by other members of family. Also with stacked cryptographic filesystems (and droidfs like equivalent on Android) it's much more convenient to have different passwords for different encrypted root-dirs. Plus that Syncthing-fork stuff - never letting it touch my plaintext files ever now lol.

Ofc droidfs and the likes can go rouge too, but much easier to analyse results, being a fully offline app (plus less incentive for them unless colluding with some other online app).

LeslieFH

Separate profile with a strong password, for backups I would sync from this profile to an encrypted cloud service like Filen or Icedrive or Proton Drive or whatever (also with a long random password, obviously).

KitsuneNoBaka

Evert profile have secure storage folder. Some file managers work with it (password/biometrics protected access).