{"action":"opened","issue":{"url":"https://api.github.com/repos/spesmilo/electrum/issues/1706","repository_url":"https://api.github.com/repos/spesmilo/electrum","labels_url":"https://api.github.com/repos/spesmilo/electrum/issues/1706/labels{/name}","comments_url":"https://api.github.com/repos/spesmilo/electrum/issues/1706/comments","events_url":"https://api.github.com/repos/spesmilo/electrum/issues/1706/events","html_url":"https://github.com/spesmilo/electrum/issues/1706","id":138905035,"number":1706,"title":"[Android] Store data on /data/data not /sdcard","user":{"login":"dllud","id":1716156,"avatar_url":"https://avatars.githubusercontent.com/u/1716156?v=3","gravatar_id":"","url":"https://api.github.com/users/dllud","html_url":"https://github.com/dllud","followers_url":"https://api.github.com/users/dllud/followers","following_url":"https://api.github.com/users/dllud/following{/other_user}","gists_url":"https://api.github.com/users/dllud/gists{/gist_id}","starred_url":"https://api.github.com/users/dllud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dllud/subscriptions","organizations_url":"https://api.github.com/users/dllud/orgs","repos_url":"https://api.github.com/users/dllud/repos","events_url":"https://api.github.com/users/dllud/events{/privacy}","received_events_url":"https://api.github.com/users/dllud/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-03-07T07:08:24Z","updated_at":"2016-03-07T07:08:24Z","closed_at":null,"body":"Electrum should follow Android guidelines and store all its data on `/data/data/org.electrum.electrum/`.\r\n\r\nCurrently Electrum stores configurations and sensitive information (wallets) on `/sdcard/electrum/`. This is wrong on many levels:\r\n- Security/Privacy: on most devices, Full Device Encryption (FDE) only encrypts `/data` directory. Files on `/sdcard`are left out. Thus, someone finding my lost phone instantly gets my wallet. He can now see all my addresses and transactions, and is one simple PIN away from spending my Bitcoins.\r\n- Backup: virtually all backup methods for Android work by copying what is on `/data`. Files on `/sdcard` are left out. Thus, Electrum's `config` file won't get backed-up.\r\n\r\n`/sdcard` should only be used for large data files, that are neither user configurations or sensitive information, and which can be easily retrieved through the Internet. Two good examples are [OsmAnd~](http://osmand.net/) map files and [QuickDic](https://github.com/rdoeffinger/Dictionary) dictionaries.\r\nOn Electrum, `blockchain_headers` would be a good candidate to be on `/sdcard`. Though, looking at the current picture, it's not worth to keep an sdcard directory just for it. `blockchain_headers` is 5 MiB big, which is little compared to the 30 MiB of Python bytecode currently stored on `/data/data/org.electrum.electrum/`.\r\n\r\n(On previous versions this unwanted behaviour was easy to change in the Python scripts. But now, with the Kivy version, things are more complex as the apk brings Python bytecode.)"}}