seedvault-app / seedvault

A backup application for the Android Open Source Project.
1.19k stars 73 forks source link

Restore list of excluded apps when restoring from backup #466

Open t-m-w opened 1 year ago

t-m-w commented 1 year ago

Keep track of the user's app exclusions in backup metadata so that when the user performs a restoration (on another device) and then installs an app that was previously excluded, Seedvault will remember that it should be excluded.

chirayudesai commented 1 year ago

I'll add that there's a chance this may be unintended. Not sure how we'd figure that out though.

But maybe the user excluded an app, uninstalled, and re-installed and now does expect it to get backed up.

Besides, If you want to exclude an app but it got backed up anyways, is much less of a problem (especially with encrypted backups) then you were expecting an app to get backed up but it got silently excluded due to old rules.

t-m-w commented 1 year ago

Maybe a notification when the package is installed...? I'm not sure if that would be noticeable enough, though, and of course it's another aspect of UI to implement.

Anyway, I think this could potentially be more of a problem when faking device-to-device transfer is implemented.

For example, there is an app I use to store passwords on-device for convenience, unlocked with biometric. I already store them in KeePass, but they're not so super-secret that I'm concerned about them being accessible with biometric alone, on-device. At the same time, I would still prefer that they only be accessible on-device and not get backed up.

The app I use supports device-to-device transfers. Somewhere along the way, its data got backed up, including the passwords. I'm not actually sure why, to be honest - could have sworn I've had it excluded all along - but apart from there being a bug somewhere, this issue could be one of many factors involved.

(Arguably, apps like this should really be using APIs for storing secrets rather than merely using the biometric as a blocker to entering the app, but it's still a thing that happens...)