Simple way to share files offline

TeamAmaze / AmazeFileManager

Material design file manager for Android

https://teamamaze.xyz

GNU General Public License v3.0

5.31k stars 1.57k forks source link

Simple way to share files offline #1317

Open EmmanuelMess opened 6 years ago

EmmanuelMess commented 6 years ago

Have a simple, naive friendly, way of sharing files. Like Mi Drop or Files Go.

TranceLove commented 6 years ago

Also used something like this in ES explorer.

Due to differences and availability of hardware features between devices (e.g. wifi direct, NFC) and multiple security concerns, I have such idea. Feel free to comment if it can be simplified.

Tell recipient to open their wifi hotspot, Amaze and open FTP server at their side. They should have disabled login at FTP server, server port is at our default (2211)
Tell sender to connect to recipient's wifi hotspot. This can be done manually (or NFC if you like)
Sender's Amaze upload file to recipient FTP server

So you'll also want to add support for FTP client in HybridFile too before this can be done.

It is possible to combine service discovery techniques to discover available recipients (which ES should have used), but it's not easy for me to accept on security grounds.

EmmanuelMess commented 6 years ago

Security concerns are something I didn't think about. My idea was that everything should be done by the app after the user opens a specific Activity, and I think you present too many and too complicated steps for some users (low technical knowledge and laziness are the main factors to account for).

TranceLove commented 6 years ago

Fair enough. I just don't feel safe to allow code to take control of my device, when there's no certificate go between handshakes or transfers without SSL connections.

I did had progresses getting Java's crypto APIs to work in Dalvik (for FTP server with implicit SSL though). If generating certificate is accepted by Google Play I may have a good use case for the workflow.

We bundle an empty keystore with our own CA cert included
Generate client cert signed with our CA cert on first install
Hand in certificate on handshake, be it over NFC or auto-discovery (don't know how they work, just an idea), so the other end can check if the cert is correctly signed
Use the cert to establish SSL socket connection to transfer files

Yes, it's still hackable, but not easy to.

TranceLove commented 6 years ago

OK, for the record. Really didn't hear about this before.

https://developer.android.com/training/connect-devices-wirelessly/wifi-direct

EmmanuelMess commented 6 years ago

If users have to agree to connect (through a "nearby devices" dialog) and have to agree to each file transfer (or all file transfers from a specific device, identified by a 256 bit id) it is easy to maintain 'secure' connections. We can then check if the metadata sent corresponds to the actual file metadata by re-obtaining the metadata and checking hashes in the receiver.

EmmanuelMess commented 5 years ago

VishalNehra commented 5 years ago

Wow how could I have miss this discussion. I had been thinking of this feature for quite a while too. @EmmanuelMess you planning to have a go of it? It'll be a major milestone for us (:

EmmanuelMess commented 5 years ago

I am trying to fix some other more pressing issues before adding more features, like concurrency issues.

EmmanuelMess commented 5 years ago

@VishalNehra Please create another project as PoC first, to test and check how well different transfer methods work.