Barry Deen
977da039df
#530 derived the Nostr private key as SHA-256(sub || index). The Google sub claim is not a secret — any app the user signs into with Google gets the same sub value for that account/OAuth-client pair, and even across clients it leaks via id_token introspection. That meant any third party with the sub could regenerate the user's nsec offline. A non-starter. Reverts to the #528 design: - GoogleSignInManager re-acquires the drive.appdata OAuth scope via AuthorizationClient - DriveBackupService reads/writes wisp_nsec_<npub>.bin blobs in the per-app appDataFolder (other apps cannot see this folder) - BackupCrypto already provided HMAC-SHA256(sub)-derived key + NIP-44 encryption; that file was not touched by #530 and is reused as-is - GoogleAuthViewModel lists backups, surfaces a chooser with avatar + display name fetched from kind-0 events, and decrypts only on explicit Restore - "Create new account" generates a fresh keypair, encrypts, and uploads a new blob The encryption key is still derived from sub, but the attack surface is fundamentally different: an attacker now needs both the sub AND read access to Wisp's appDataFolder in the user's Drive. The folder is sandboxed per-app, so the only paths in are the user's own Google account or a Wisp app compromise. That's the same trust boundary as "can sign in to the user's Google account." Splash button styling kept as-is (dark variant from #530 retained — a cosmetic choice independent of the security model). Reverts:3d3c6e1,de88bdd
83 lines
5.6 KiB
TOML
83 lines
5.6 KiB
TOML
[versions]
|
|
kotlin = "2.0.21"
|
|
agp = "8.13.2"
|
|
compose-bom = "2024.12.01"
|
|
okhttp = "4.12.0"
|
|
kotlinx-serialization = "1.7.3"
|
|
secp256k1-kmp = "0.19.0"
|
|
coil = "3.0.4"
|
|
security-crypto = "1.1.0-alpha06"
|
|
bouncycastle = "1.78.1"
|
|
media3 = "1.5.1"
|
|
biometric = "1.1.0"
|
|
coroutines = "1.9.0"
|
|
profileinstaller = "1.4.1"
|
|
splashscreen = "1.0.1"
|
|
zxing = "3.5.3"
|
|
mlkit-translate = "17.0.3"
|
|
mlkit-language-id = "17.0.6"
|
|
mlkit-barcode = "17.3.0"
|
|
camerax = "1.4.1"
|
|
objectbox = "5.2.0"
|
|
breez-sdk-spark = "0.11.0"
|
|
activity-compose = "1.9.3"
|
|
navigation-compose = "2.8.5"
|
|
lifecycle = "2.8.7"
|
|
credentials = "1.3.0"
|
|
googleid = "1.1.1"
|
|
play-services-auth = "21.3.0"
|
|
|
|
[libraries]
|
|
compose-bom = { group = "androidx.compose", name = "compose-bom", version.ref = "compose-bom" }
|
|
compose-ui = { group = "androidx.compose.ui", name = "ui" }
|
|
compose-ui-graphics = { group = "androidx.compose.ui", name = "ui-graphics" }
|
|
compose-material3 = { group = "androidx.compose.material3", name = "material3" }
|
|
compose-icons-extended = { group = "androidx.compose.material", name = "material-icons-extended" }
|
|
activity-compose = { group = "androidx.activity", name = "activity-compose", version.ref = "activity-compose" }
|
|
navigation-compose = { group = "androidx.navigation", name = "navigation-compose", version.ref = "navigation-compose" }
|
|
lifecycle-viewmodel-compose = { group = "androidx.lifecycle", name = "lifecycle-viewmodel-compose", version.ref = "lifecycle" }
|
|
lifecycle-runtime-compose = { group = "androidx.lifecycle", name = "lifecycle-runtime-compose", version.ref = "lifecycle" }
|
|
okhttp = { group = "com.squareup.okhttp3", name = "okhttp", version.ref = "okhttp" }
|
|
kotlinx-serialization-json = { group = "org.jetbrains.kotlinx", name = "kotlinx-serialization-json", version.ref = "kotlinx-serialization" }
|
|
kotlinx-coroutines-android = { group = "org.jetbrains.kotlinx", name = "kotlinx-coroutines-android", version.ref = "coroutines" }
|
|
secp256k1-kmp = { group = "fr.acinq.secp256k1", name = "secp256k1-kmp", version.ref = "secp256k1-kmp" }
|
|
secp256k1-kmp-jni-android = { group = "fr.acinq.secp256k1", name = "secp256k1-kmp-jni-android", version.ref = "secp256k1-kmp" }
|
|
coil-compose = { group = "io.coil-kt.coil3", name = "coil-compose", version.ref = "coil" }
|
|
coil-gif = { group = "io.coil-kt.coil3", name = "coil-gif", version.ref = "coil" }
|
|
coil-network-okhttp = { group = "io.coil-kt.coil3", name = "coil-network-okhttp", version.ref = "coil" }
|
|
coil-video = { group = "io.coil-kt.coil3", name = "coil-video", version.ref = "coil" }
|
|
security-crypto = { group = "androidx.security", name = "security-crypto", version.ref = "security-crypto" }
|
|
bouncycastle = { group = "org.bouncycastle", name = "bcprov-jdk18on", version.ref = "bouncycastle" }
|
|
media3-exoplayer = { group = "androidx.media3", name = "media3-exoplayer", version.ref = "media3" }
|
|
media3-exoplayer-hls = { group = "androidx.media3", name = "media3-exoplayer-hls", version.ref = "media3" }
|
|
media3-datasource-okhttp = { group = "androidx.media3", name = "media3-datasource-okhttp", version.ref = "media3" }
|
|
media3-ui = { group = "androidx.media3", name = "media3-ui", version.ref = "media3" }
|
|
media3-session = { group = "androidx.media3", name = "media3-session", version.ref = "media3" }
|
|
biometric = { group = "androidx.biometric", name = "biometric", version.ref = "biometric" }
|
|
profileinstaller = { group = "androidx.profileinstaller", name = "profileinstaller", version.ref = "profileinstaller" }
|
|
splashscreen = { group = "androidx.core", name = "core-splashscreen", version.ref = "splashscreen" }
|
|
zxing-core = { group = "com.google.zxing", name = "core", version.ref = "zxing" }
|
|
mlkit-translate = { group = "com.google.mlkit", name = "translate", version.ref = "mlkit-translate" }
|
|
mlkit-language-id = { group = "com.google.mlkit", name = "language-id", version.ref = "mlkit-language-id" }
|
|
mlkit-barcode = { group = "com.google.mlkit", name = "barcode-scanning", version.ref = "mlkit-barcode" }
|
|
camerax-core = { group = "androidx.camera", name = "camera-core", version.ref = "camerax" }
|
|
camerax-camera2 = { group = "androidx.camera", name = "camera-camera2", version.ref = "camerax" }
|
|
camerax-lifecycle = { group = "androidx.camera", name = "camera-lifecycle", version.ref = "camerax" }
|
|
camerax-view = { group = "androidx.camera", name = "camera-view", version.ref = "camerax" }
|
|
camerax-mlkit = { group = "androidx.camera", name = "camera-mlkit-vision", version.ref = "camerax" }
|
|
kotlinx-coroutines-play-services = { group = "org.jetbrains.kotlinx", name = "kotlinx-coroutines-play-services", version.ref = "coroutines" }
|
|
objectbox-android = { group = "io.objectbox", name = "objectbox-android", version.ref = "objectbox" }
|
|
objectbox-kotlin = { group = "io.objectbox", name = "objectbox-kotlin", version.ref = "objectbox" }
|
|
breez-sdk-spark = { group = "breez_sdk_spark", name = "bindings-android", version.ref = "breez-sdk-spark" }
|
|
androidx-credentials = { group = "androidx.credentials", name = "credentials", version.ref = "credentials" }
|
|
androidx-credentials-play-services-auth = { group = "androidx.credentials", name = "credentials-play-services-auth", version.ref = "credentials" }
|
|
googleid = { group = "com.google.android.libraries.identity.googleid", name = "googleid", version.ref = "googleid" }
|
|
play-services-auth = { group = "com.google.android.gms", name = "play-services-auth", version.ref = "play-services-auth" }
|
|
|
|
[plugins]
|
|
android-application = { id = "com.android.application", version.ref = "agp" }
|
|
kotlin-android = { id = "org.jetbrains.kotlin.android", version.ref = "kotlin" }
|
|
kotlin-compose = { id = "org.jetbrains.kotlin.plugin.compose", version.ref = "kotlin" }
|
|
kotlin-serialization = { id = "org.jetbrains.kotlin.plugin.serialization", version.ref = "kotlin" }
|
|
objectbox = { id = "io.objectbox", version.ref = "objectbox" }
|