patrickd
- 16 days ago
- Joined Nov 8, 2024
horde Dang, I didn't get a notification for this!
I can totally see why experienced GrapheneOS users wouldn't be impressed by this article, but to be fair, I didn't write it for them ¯_(ツ)_/¯
Responded and will make some adjustments to address the constructive criticism that was raised, thanks for pinging!
Thank you for sharing!
I'll try to keep it up to date as long as reasonable, at least until it would require significant changes - and at that point I'll be sure to add a warning about it being outdated.
- Edited
Inter Profile Sharing dev here (Hello!)
ryrona Until then, I transfer files to my computer and back to the other profile using MTP over USB-C. That avoids exposing the file metadata to the internet or even local network, avoids exposing the files unencrypted to the USB stick, and avoids relying on possibly unaudited third-party apps.
Just to clarify: Inter Profile Sharing specifically only listens to connections on the local loopback device. Even while your phone is connected to a network, nobody in that same network should be able to connect to it. Furthermore, with encryption enabled not even other applications on the same device will be able to obtain any information on what is being shared.
The App has indeed not been audited by a third-party so far (paying for a professional review isn't really reasonable for a hobby project that I mostly wrote for myself). I made sure to thoroughly document and comment the code though, and I welcome anyone to take a look at the code, it's really quite simple. The App has 2000 lines of code, most of which is UI-related boilerplate.
For the curious I've picked out the most relevant code-parts here:
- MainActivity.kt#L31-L69 - Main user Interface starts the ServerService when there's something to share
- ServerService.kt#L62-L241 - ServerService starts listening on TCP port and serves shared files
- EncryptionUtils.kt#L89-L205 - Optionally used stream-wrappers to encrypt traffic with AES-GCM
- ClientService.kt#L78-L218, #L694-L768 - ClientService is triggered by various events to check whether the ServerService has opened a port, checks whether any new files are being shared, creates notifications for those, allows fetching files if wanted
zzz Side question - could one use a localhost solution via native GOS tools only, without trusting a new app?
I didn't find one, but you could instead use KDE Connect, it's not quite as convenient but it gets the job done and should be easier to trust. It even works without any network connection at all if you pair profiles manually via 127.0.0.1
It's totally understandable to question new random apps that pop out of nowhere. Let me know if there are any other concerns I can try to clear up!
Cheers