Encryption of User data

[sakshampruthi]

Encrypt profile details that are uploaded or stored on firebase so that only user can access these details

[TaraStefanyi]

Is this issue still unresolved?

[sakshampruthi]

@TaraStefanyi Yes, it is still unresolved. How do you plan to resolve it?

[TaraStefanyi]

I was thinking about generating and storing a secret key safely on user's device (maybe shared preferences or a single file in app's folder). Then we would use this key to encrypt/decrypt the data.

[sakshampruthi]

@TaraStefanyi Sure, go ahead give it a try and if possible try it in the MVVM branch

[TaraStefanyi]

@sakshampruthi I just wanted to ask what data should be encrypted...

[sjain30]

Hi @TaraStefanyi Sorry for the late reply
For starters, we're planning to encrypt the personal details of the user before uploading to Firebase and decrypt it wherever we're accessing it in the app. The user details are being uploaded in step two of the signup page.

[zubusoomro]

I was thinking about generating and storing a secret key safely on user's device (maybe shared preferences or a single file in app's folder). Then we would use this key to encrypt/decrypt the data.

what if user uninstall's the app and install's the app again ? would he be able to retrieve his data again ? i don't think so.

[rzuhovski0]

Hello, is this issue still open? Instead of using local storage (since the files will be deleted after the app uninstall) I would use Password-Based Key Derivation Function (PBKDF).
1.)On Signup:

• Generate a salt and use the user’s password to derive an encryption key.
• Encrypt the personal details using the derived key and upload both the encrypted data and the salt to Firebase.
  2.)On Login:
• Retrieve the encrypted data and the salt from Firebase.
• Use the user’s password and the stored salt to derive the encryption key.
• Decrypt the data using this key.

No key storage on device: The encryption key is derived dynamically from the user's password each time it's needed.
Reusable user input: It leverages the user’s existing password, avoiding the need for extra key management.

If you like this approach, please let me know and assign the issue to me.