Code You Can Trust on Guardian Project

Clean Insights: Privacy Preserving Measurement

Thu, 09 Dec 2021 11:00:55 -0400

Clean Insights gives developers a way to plug into a secure, private measurement platform. It is focused on assisting in answering key questions about app usage patterns, and not on enabling invasive surveillance of all user habits. Our approach provides programmatic levers to pull to cater to specific use cases and privacy needs. It also provides methods for user interactions that are ultimately empowering instead of alienating.

Clean Insights is available as a lightweight, minimal impact, freely licensed toolkit to include in your mobile app, desktop app, website or back-end service. This code can be integrated into your application or service to measure specific events and interactions that you want to gain more insight on.

Learn more at CleanInsights.org

Wind: Off-Grid Services for Everyday People

Wed, 15 Nov 2017 18:11:44 -0400

GitHub - blog posts

When disaster strikes, connectivity becomes difficult. Information can save your life, guiding you to safety and services. Networks today are fragile and easy overloaded. There has not been enough investment in the many other possible nets, that may be better suited for situations where connections to the global internet are not available or affordable. The potential in radios, sensors and processing available in the cheapest of smartphones and routers are not fully utilized or realized.

Wind is a network designed for opportunistic communication and sharing of local knowledge. It is built on impermanence, movement, and spontaneity. Wind is a direct counterpoint to the metaphor of the Web, a system built upon the concept of fixed physical nodes, centralized authorities and permanent links. It is rooted in the mindsets and needs of people and communities who face challenges communicating. Wind is shaped by the movements and density of people in time and space.

Background Information

Source code & Public Works

Wind Poster Credits:

Written by Nathan Freitas, Guardian Project

Editing and graphics by Carrie Winfrey, Okthanks

Starlings—“A murmuration of starlings” by Adam is licensed under CC BY 2.0. The image is a derivative of the original.

Survivor—“Wat Pathum Wanaram” by Adaptor-Plug is licensed under CC BY-NC 2.0

Community Organizer—“DSC_2318” by Chabad Lubavitch is licensed under CC BY 2.0

Medical worker—“Me” by Lee Cannon is licensed under CC BY-SA 2.0

Journalist—“DSCF52321” by Chabad Lubavitch is licensed under CC BY 2.0

“Headlight” icon by Identidea, from the Noun Project

“Network” icon by UNiCORN, from the Noun Project

“Router” icon by Focus, from the Noun Project

“Verified” icon by Bestdesignmarket, from the Noun Project

PanicKit: system-wide panic responses

Thu, 11 Jun 2015 00:00:00 +0000

GitLab - GitHub - Javadoc - blog posts

PanicKit is a collection of tools for creating “panic buttons” that can trigger a system-wide response when the user is in an anxious or dangerous situation. It enables trigger apps and responder apps to safely and easily connect to each other. The user engages with the trigger app when in a panic situation. The responder apps receive that trigger signal, and individually execute the steps that they were configured to do. The connections between trigger and responder can be strictly enforced based on Application ID and APK signing certificate. There are two general categories of response:

default, non-destructive
opt-in, destructive

Screenshots

Building apps with panic support

Examples

Real world apps

Downloads

The binary jar, source jar, and javadoc jar are all available on jcenter. To include them using gradle, add this line to your build.gradle:

implementation 'info.guardianproject.panic:panic:1.0'

Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures:

panic-1.0.jar - (PGP signature)
panic-1.0-sources.jar - (PGP signature)
panic-1.0-javadoc.jar - (PGP signature)

Core Concepts

non-destructive vs destructive responses
responders should have a default response
default responses should be non-destructive
users send the panic with a trigger app
responder apps receive the trigger message and do something in response
the user must opt in to destructive responses via “connecting” a trigger and response app
the trigger method can include things like a text message, email addresses, phone numbers, etc. which a panic responder app can use to send the message.
responder apps should do something without any configuration, but that default response can be limited to trusted trigger apps
the trigger app can ignore any given responder
a responder app can ignore all triggers

Since this is an Android-specific framework, it builds upon core ideas to Android OS, like Intent, Activity, and Service. The panic trigger message is an Intent that can be received by Activitys or Services. The Service must be an IntentService or started with startService(Intent) in order to receive the panic trigger Intent.

Implementing a panic UX

These are all of the core behaviors that are required by a good PanicKit user experience:

every panic responder must accept ACTION_TRIGGER Intents as the trigger
each app has only one Activity that receives ACTION_TRIGGER
each app has only one Activity that receives ACTION_CONNECT
each app has only one Activity that receives ACTION_DISCONNECT
the trigger app sends ACTION_CONNECT, ACTION_DISCONNECT, and ACTION_TRIGGER to the responder
the responder app sends ACTION_CONNECT and ACTION_DISCONNECT to the trigger
only the user can trigger ACTION_CONNECT to be sent, they should never be automated
the Activity that accepts ACTION_CONNECT will TOFU-trust the app that sent the Intent after the user opts in
the Activity that sends ACTION_CONNECT will TOFU-trust the receiver, if it replies with Activity.RESULT_OK
ACTION_TRIGGER will only trigger destructive responses after it has been verified that they came from a trusted sender (either pinned or TOFUed)
either trigger or responder can send ACTION_DISCONNECT at any time
receiving ACTION_DISCONNECT does not result in user interaction, the disconnect is immediate
a trigger app can send ACTION_TRIGGER to zero or more apps
a responder app can receive ACTION_TRIGGER from a single app
one user panic button press can send multiple trigger events

Configuration

the config screen has two final actions: 1) cancel changes 2) confirm changes
when disconnected, clicking confirm creates the connection
when disconnected, clicking cancel makes no connection
when already connected, clicking confirm will change the settings and keep the connection
when already connected, clicking cancel will discard changes to the settings but keep the connection

PanicKit in Action

Trust modes

It is possible to require strict checking of panic senders and receivers. For example, a panic trigger message might include a private message, the location, and a list of trusted contacts. This is sensitive information, so the trigger app should only send it to apps that the user has allowed to receive it. Also, many panic responses include destroying data or sending messages to trusted contacts. These actions must require the user to opt-in, granting a specific trigger app the privilege to trigger those sensitive responses.

The enhanced trust relationship between trigger and responder can take two forms:

Trust-On-First-Use (TOFU) App

A user goes into the settings of either a panic trigger or receiver, and configures which apps to connect to. In this process, the apps remember the other apps they are each connected to, and base their trusted sending on that initial connection.

Pinned Trusted App

Using trusted pinning methods like APK signing key, a panic trigger and panic receiver can automatically configure themselves to connect to all installed apps that are signed by a given key. This gives a panic setup with zero configuration. For example, Courier Reader could automatically connect to Amnesty Panic Button based on signing key.

CacheWord: Passphrase Caching and Management

Fri, 26 Sep 2014 21:44:19 -0400

GitLab - GitHub - Javadoc - blog posts

CacheWord is an Android library project for passphrase caching and management.
It helps app developers securely generate, store, and access secrets derived
from a user’s passphrase. It is designed to work easily with IOCipher and SQLCipher-for-Android, but it can be used any time an app needs to manage a password. Broadly speaking this library assists developers with two related problems:

Secrets Management: how the secret key material for your app is generated, stored, and accessed
Passphrase Caching: store the passphrase in memory to avoid constantly prompting the user

CacheWord manages key derivation, verification, persistence, passphrase resetting, and caching secret key material in memory.

Features

Strong key derivation (PBKDF2)
Dynamic KDF iteration count based on CPU speed
Secure secret storage (AES-256 GCM)
Persistent notification: informs the user the app data is unlocked
Configurable timeout: after a specified time of inactivity the app locks itself
Manual clearing: the user can forcibly lock the application

Source Code Repository

library, helpers, tests, and sample project: https://github.com/guardianproject/cacheword

Downloads

The binary jar, source jar, and javadoc jar are all available on jcenter. To include them using gradle, add this line to your build.gradle:

implementation 'info.guardianproject.cacheword:cachewordlib:0.1.1'

Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures:

TrustedIntents: flexible trusted interactions between Android apps

Mon, 23 Jun 2014 00:00:00 +0000

GitLab - GitHub - blog posts

TrustedIntents is a library for flexible trusted interactions between Android apps. It is modeled after Android’s signature protection level for permissions. The key difference is that the framework allows the trusted signature to be set, rather than requiring to match the current app’s signature.

For more info:

Downloads

The binary jar, source jar, and javadoc jar are all available on jcenter. To include them using gradle, add this line to your build.gradle:

implementation 'info.guardianproject.trustedintents:trustedintents:%!s(<nil>)'

Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures:

License

This library is licensed under the LGPLv2.1. We believe this is compatible with all reasonable uses, including proprietary software, but let us know if it provides difficulties for you. For more info on how that works with Java, see:

https://www.gnu.org/licenses/lgpl-java.en.html

NetCipher: Secured Networking

Mon, 29 Apr 2013 11:00:55 -0400

GitLab - GitHub - Javadoc - blog posts

Better TLS and Tor App Integration

NetCipher is a library for Android that provides multiple means to improve network security in mobile applications. It provides best practices TLS settings using the standard Android HttpURLConnection methods, HttpURLConnection, OkHTTP3, Volley, and Apache HTTP Client, provides simple Tor integration, makes it easy to configure proxies for HTTP connections and WebView instances.

More specifically this library provides:

Hardening of TLS protocol support and cipher suites, especially on older
versions of Android
Proxied Connection Support: HTTP and SOCKS proxy connection support for HTTP
and HTTPS traffic through specific configuration
OrbotHelper: a utility class to support application integration with Orbot
(Tor for Android). Check if its installed, automatically start it, etc.
Optional, custom certificate store based on the open Debian root CA trust
store, which is built with Mozilla’s CA collection.

IT MUST BE NOTED, that you can use this library without using Orbot/Tor, but obviously we think using strong TLS/SSL connections over Tor is just about the best thing in the world.

https://github.com/guardianproject/NetCipher

This library was formerly named OnionKit

Getting Started

For examples and more info on using NetCipher, see the README and included sample projects. Many apps include NetCipher, so they can also serve as examples of NetCipher in action:

Sample Projects

Apps

F-Droid

Downloads

The binary jar, source jar, and javadoc jar are all available on jcenter. To include them using gradle, add this line to your build.gradle:

implementation 'info.guardianproject.netcipher:netcipher:2.2.0-alpha'

Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures:

For working with popular HTTP libraries or android.webkit, use the specific NetCipher library that matches:

    implementation 'info.guardianproject.netcipher:netcipher-webkit:2.2.0-alpha
    implementation 'info.guardianproject.netcipher:netcipher-okhttp3:2.2.0-alpha
    implementation 'info.guardianproject.netcipher:netcipher-httpclient:2.2.0-alpha
    implementation 'info.guardianproject.netcipher:netcipher-volley:2.2.0-alpha
    implementation 'info.guardianproject.netcipher:netcipher-chboye:2.2.0-alpha

These files can also be downloaded directly from jcenter, including the PGP signatures:

IOCipher: Virtual Encrypted Disks

Thu, 04 Oct 2012 00:39:12 -0400

GitLab - GitHub - Javadoc - blog posts

IOCipher provides a virtual encrypted disk for Android apps without requiring the device to be rooted. It uses a clone of the standard java.io API for working with files, so developers already know how to use it. Only password handling, and opening the virtual disk are what stand between the developer and working encrypted file storage. It is based on and SQLCipher, and designed to work with CacheWord for handling the keys and passwords.

IOCipher is ultimately based on transactions in SQLite, which means that it does not require being mounted in the normal sense. There is no open state once a transaction is complete. Each read or write operation is a self-contained SQLite transaction, so if the file system is forcably quit, SQLite’s transactions prevent the whole file system from being corrupted. This is important in Android since an Activity or Service can be killed at any moment without warning.

IOCipher is a cousin to SQLCipher-for-Android since it is also based on SQLCipher and uses the same approach of repurposing an API that developers already know well. It is built on top of libsqlfs, a filesystem implemented in SQL that exposes a FUSE API.

Features

Secure transparent app-level virtual encrypted disk
No root required
Only three new methods to learn: VirtualFileSystem.get(), VirtualFileSystem.mount(dbFile, password), and VirtualFileSystem.unmount()
Supports Android versions 2.3 and above
Licensed under the LGPL v3+

Adding IOCipher to your App

Here are the things you need to do in your code to make it use IOCipher encrypted storage for all of your app’s file storage:

manage the password using Cacheword or whatever works for you
get the VFS singleton using VirtualFileSystem.get()
on first run, create the container file with a password using VirtualFileSystem.createNewContainer(dbFile, password)
mount the container file with a password using VirtualFileSystem.mount(dbFile, password)

replace the relevant java.io import statements with info.guardianproject.iocipher, e.g.:

import info.guardianproject.iocipher.File;
import info.guardianproject.iocipher.FileOutputStream;
import info.guardianproject.iocipher.FileReader;
import info.guardianproject.iocipher.IOCipherFileChannel;
import info.guardianproject.iocipher.VirtualFileSystem;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.InputStream;
import java.nio.channels.Channels;
import java.nio.channels.ReadableByteChannel;

For more detailed examples, see IOCipherExample, IOCipherThreadTest, and IOCipherTests. To start from scratch, follow the instructions on starting with SQLCipher-for-Android, then download IOCipher and add it to the libs/ folder of that new project.

Downloads

For gradle projects, use one of these lines. The quickest way to get started is to use the standalone package that includes SQLCipher in it.

    implementation 'info.guardianproject.iocipher:IOCipherStandalone:0.5@aar'

If your project already includes SQLCipher, then use the release that contains only IOCipher.

    implementation 'info.guardianproject.iocipher:IOCipher:0.5@aar'
    implementation 'net.zetetic:android-database-sqlcipher:4.2.0@aar'

Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures:

Source Code

all you need for your project: https://github.com/guardianproject/IOCipher

optional:

the test suite: https://github.com/guardianproject/IOCipherTests
a simple example file manager app: https://github.com/guardianproject/IOCipherExample
a very simple test app: https://github.com/guardianproject/IOCipherThreadTest
the core: https://github.com/guardianproject/libsqlfs

Usage notes

only one active mount per-app is supported
single thread/sequential access is the preferred way of using IOCipher
multi-threaded access possible (potentially unstable under extremely high write load)
VFS now has beginTransaction and completeTransaction to optimize performance
parts of java.io not currently supported: vectored I/O, memory-mapped files

Reporting Bugs

Please report any bugs or issues that you have with this library! We want to hear from you. Help us improve this software by filing bug reports about any problem that you encounter. Feature requests and patches are also welcome!

Known Issues

files cannot currently be larger than 4GB (#3624)
no users, groups, or permissions implemented
crashes possible under extremely heavy, concurrent load (#522)
View all open issues

libsqlfs: filesystem on top of SQLite/SQLCipher

Thu, 27 Oct 2011 00:00:00 +0000

GitLab - GitHub - blog posts

libsqlfs provides a complete virtual disk on top of a SQLite or SQLCipher database. The virtual disk is encrypted and contained in a single file, which can be easily moved around, copied, shared, etc. It is a standard FUSE filesytem that can work on Android, GNU/Linux, and perhaps also macOS.

SQLCipher: Encrypted Database

Sat, 19 Feb 2011 08:27:13 -0400

GitHub - blog posts

In an environment where mobile data privacy is increasingly in the headlines, this project will make it easier than ever for mobile developers to properly secure their local application data, and in turn better protect the privacy of their users. The data stored by Android apps protected by this type of encryption will be less vulnerable to access by malicious apps, protected in case of device loss or theft, and highly resistant to mobile data forensics tools that are increasingly used to mass copy a mobile device during routine traffic stops.

SQLCipher is a SQLite extension that provides transparent 256-bit AES encryption of database files. To date, it has been open-sourced, sponsored and maintained by Zetetic LLC. In the mobile space, SQLCipher has enjoyed widespread use in Apple’s iOS, as well as Nokia / QT for quite some time. Given that Android by default provides integrated support for SQLite databases, our goal was to create an almost identical API for SQLCipher, so that developers of all skill level could use it, without a steep learning curve.

Learn More and Download

An Illustrative Terminal Listing

A typical SQLite database in unencrypted, and visually parseable even as encoded text. The following example shows the difference between hexdumps of a standard SQLite db and one implementing SQLCipher.

~ sjlombardo$ hexdump -C sqlite.db
00000000 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 |SQLite format 3.|
…
000003c0 65 74 32 74 32 03 43 52 45 41 54 45 20 54 41 42 |et2t2.CREATE TAB|
000003d0 4c 45 20 74 32 28 61 2c 62 29 24 01 06 17 11 11 |LE t2(a,b)$…..|
…
000007e0 20 74 68 65 20 73 68 6f 77 15 01 03 01 2f 01 6f | the show…./.o|
000007f0 6e 65 20 66 6f 72 20 74 68 65 20 6d 6f 6e 65 79 |ne for the money|

~ $ sqlite3 sqlcipher.db
sqlite> PRAGMA KEY=‘test123’;
sqlite> CREATE TABLE t1(a,b);
sqlite> INSERT INTO t1(a,b) VALUES (‘one for the money’, ‘two for the show’);
sqlite> .quit

~ $ hexdump -C sqlite.db
00000000 84 d1 36 18 eb b5 82 90 c4 70 0d ee 43 cb 61 87 |.?6.?..?p.?C?a.|
00000010 91 42 3c cd 55 24 ab c6 c4 1d c6 67 b4 e3 96 bb |.B?..?|

00000bf0 8e 99 ee 28 23 43 ab a4 97 cd 63 42 8a 8e 7c c6 |..?(#C??.?cB..|?|

~ $ sqlite3 sqlcipher.db
sqlite> SELECT * FROM t1;
Error: file is encrypted or is not a database

(example courtesy of SQLCipher)

Details for Developers

We’ve packaged up a very simple SDK for any Android developer to add SQLCipher into their app with the following three steps:

Add a single sqlcipher.jar and a few .so’s to the application libs directory
Update the import path from android.database.sqlite.* to info.guardianproject.database.sqlite.* in any source files that reference it. The original android.database.Cursor can still be used unchanged.
Init the database in onCreate() and pass a variable argument to the open database method with a password*:

SQLiteDatabase.loadLibs(this); //first init the db libraries with the context

SQLiteOpenHelper.getWritableDatabase(“thisismysecret”):

*Note: we are working on some dialog builder helper methods for password and PIN input, password caching, and other features that we would like to standardize across all applications that use SQLCipher.

Compatibility

The Developer Preview implements SQLCipher v1, is compatible with Android 2.2 & 2.3, and works only within one process (you can’t pass a Cursor from a remote Service to an Activity).

Notepad + SQLCipher = Notepadbot

Notepadbot is a sample application pulled from the standard Android samples code and updated to use SQLCipher. You can browse the source here and download the apk here.

Final Notes

It’s important to note that this project is not intended to be a distinct, long-term fork of SQLCipher. We’ve been working closely with the SQLCipher team at Zetetic and fully intent to closely maintain the project as SQLCipher evolves, re-integrating changes in upcoming releases such as SQLCipher v2.

The Android support libraries are licensed under Apache 2.0, in line with the Android OS code on which they are based. The SQLCipher code itself is licensed under a BSD-style license from Zetetic LLC. Finally, the original SQLite code itself is in the public domain.

TorService: Tor library for Android

Mon, 01 Jan 0001 00:00:00 +0000

GitLab - GitHub - Javadoc - blog posts

This is native Android TorService built on the Tor shared library built for Android. It is designed around the Android lifecycle. The included libtor.so binaries can also be used directly as a tor daemon. This is used in Orbot, TorServices, OnionShare, and more.

Features

Native Android TorService for running Tor in a background service
Designed around modern Android tools like WorkManager
Reproducible Build with included Vagrant setup for running them

Source Code Repository

library, helpers, tests, and sample project: https://github.com/guardianproject/tor-android

Downloads

The binary jar, source jar, and javadoc jar are all available on jcenter. To include them using gradle, add this line to your build.gradle:

implementation 'info.guardianproject:tor-android:0.4.7.14'

Otherwise, the files can also be downloaded directly from jcenter, including the PGP signatures: