App Crash on Android 4.3, Galaxy S3 about cordova-plugin-secure-storage HOT 10 CLOSED

Which android version is the device running?

from cordova-plugin-secure-storage.

It's running android 4.3.

from cordova-plugin-secure-storage.

Well, that's your problem. We need API 19, which is available from 4.4.

from cordova-plugin-secure-storage.

In that case you should consider adding the required api version in your plugin.xml

<preference name="android-minSdkVersion" default="19" />

from cordova-plugin-secure-storage.

You are right of course. We actually had it in plugin.xml. If my memory does not deceive me it caused some problems with either ionic or phonegap, which is why we removed it and added the info in the README. Once I have the time I will dig the issue and see if it is still a problem, otherwise put it back.

from cordova-plugin-secure-storage.

For reference this is the issue in question: #8

from cordova-plugin-secure-storage.

Is there a possibility of a graceful fallback for those devices? Can you save data unsecured in those cases and/or inform the app about not being able to save data secure with the option of letting it handle the data saving in an alternative storage?

from cordova-plugin-secure-storage.

Problem is the android part of the plugin has already become overly complex in order to support the various variants. We now support two versions of AES, one native and one done through js depending on whether we are on >21 or not. This is because there is no keychain/vault built-in.

Eventually I would like to even drop support for android < 21, but that's not going to happen very soon.

You could in principle add a third compatibility layer where public/private key encryption happens with sjcl through elliptic curves. But that would be a nightmare to manage I am afraid.

I would suggest the following:
During initialisation detect whether we are on android > 21 and fail gracefully if not. There are already checks there to see whether there is a lock pattern etc on the device which is the other way init should fail. If initialisation fails the app could decide whether to inform the user that his data will not be secure or implement some other method.

from cordova-plugin-secure-storage.

Thank you for your detailed answer!

from cordova-plugin-secure-storage.

A pleasure.

from cordova-plugin-secure-storage.