rucceett

Looks pretty interesting, especially storing mails locally.

For promoting privacy, the app unfortunately sends way too many requests to Heap Analytics (basically every touch you do within the app).

Even worse, the app sends the mail address you entered via plain HTTP to a Heroku app (for figuring out mailserver configuration).

This is what the request looks like:

> GET http://slidemailstaging.herokuapp.com/validate_email/abc@exa... <- 200 application/json 173B

Once you reduce analytics and send stuff like this via HTTPS (or even better ask me whether I want to send my mail address to your server), I'd be happy to try the app.

There is a keychain-backed method. Read the end of the article.

Summary: The Dropbox passcode lock is only a view preventing access to the app, but does not encrypt anything. Dropbox' use of Touch ID does not improve on this and it uses a Touch ID API that only provides a yes/no answer.

Instead, it could actually grant access to cryptographic keys. As, however, the keys would still be stored on the device (although in the keychain), this is merely a compromise, albeit one which could actually provide added value (ACL protected items are not backed up).

That's all Touch ID can do. The data stored in the keychain (with a kSecAccessControlUserPresence ACL) is encrypted with a key the secure enclave needs to provide (or it is asked to decrypt an item-specific key). So without the secure enclave agreeing, which it only does when it finds a matching fingerprint, you can't get the data. What more can you expect?

I just tried that and I didn't receive old messages. My guess is people who noticed this used iCloud Backup, restored the new device and once they logged in to the iMessage account, the Messages App showed the existing messages restored from the backup.