What it protects against, what it doesn’t, and how to get the most from it.
What it protects against
- Someone looking through your phone. Files in the vault do not appear in your gallery or other apps. After you import something, Ciphergrove can offer to remove the original so it doesn’t stay visible elsewhere.
- Someone copying your data. Files and the database are encrypted with AES-256. The keys are protected by your phone’s secure hardware and by your PIN or biometrics, so a copy of the app’s data is not enough to read your files.
- Guessing your PIN. Wrong attempts cause growing waits. The app also keeps a log of failed unlock attempts and shows it to you after the next good unlock. You can unlock with a PIN, a password or a pattern (a pattern is quicker but easier to guess).
- Someone forcing you to open the app. You can keep a second vault: a second PIN opens a separate vault with its own key, database, files and recovery code, and nothing inside it shows that another one exists. A panic wipe PIN, typed on the lock screen, or the Wipe now button erases every vault, so you can protect your files if you are about to lose control of your phone. There is one wipe PIN for the whole app, set from the first vault. A wipe also erases files kept on an SD card and the saved server addresses and passwords. A second vault that came from an older decoy vault is an ordinary second vault, so a wipe erases it too.
- Someone using your unlocked phone. A folder can have its own PIN. Until it is typed, its pictures and files stay hidden, including in Favorites and tags.
- Hidden details in your photos. A photo can carry its location, the camera and the app that last saved it. Ciphergrove shows you what each photo reveals, so you know before you share it. What a photo reveals.
- Leaving the vault open. By default, leaving the app locks it and removes it from recent apps. You can choose an auto-lock delay, lock immediately with the Lock now button, or shake the phone to lock. Screenshots and the recent-apps preview are blocked.
- Tampering. Each file is protected so that changed or damaged data is detected and not silently accepted. Videos are protected in chunks, so chunks can’t be reordered or removed unnoticed.
What it doesn’t protect against
Please read this part. Knowing the limits helps you stay safe.
- A compromised or infected phone. If malware or someone else controls your phone while the vault is open, no app can protect what is on the screen.
- Someone who knows your PIN, or watches you type it. Use a PIN that is hard to guess, and consider biometrics in private.
- Files you export, share or open in another app. Once a file leaves the vault, it is not protected by Ciphergrove. When you open a file in another app, Ciphergrove warns you that a temporary unencrypted copy is made, and deletes it when you return, when the vault locks, and at the next start.
- The web. Websites you visit in the built-in browser can see your IP address and browser type, as in any browser. Files you download are saved into the vault.
- Ads in the free version. The ad service receives advertising data as described in the privacy policy. It never receives your files or file names.
- Being seen to have the app. The app is visible on your phone. You can change its name and icon in the app list (Settings, Security, Disguise), but your phone’s own Settings still lists it under its real name, and nothing can change what other people already know.
- Losing both your unlock method and your recovery code. We don’t have a copy of your keys and can’t recover your files. See Backup & recovery.
- The places you send backups and archived files to. They leave the phone encrypted, and a backup needs your recovery code to be read. But whoever controls the server, SD card or USB drive can delete the data, and can see that it exists, when it was written and how big it is. They can also put an older copy of a backup back in its place: Ciphergrove cannot know that a backup you restore on a new phone is the newest one, so check its date. On the same phone it warns you when the newest backup it stored has been removed or changed. A file you archived is checked against a checksum kept inside your vault when you retrieve it, so a swapped, older or damaged copy is refused. An archived file exists only on the server, so keep a backup. Ciphergrove checks a server’s fingerprint but cannot make a weak server password strong.
- Legal or physical pressure. No software can guarantee protection in every situation.
How it works, in plain language
When you set up Ciphergrove, your phone creates a random vault key. That key is never stored as is. It is wrapped (encrypted) by a key held in your phone’s secure hardware and, in PIN mode, also by your PIN. Each file then gets its own key derived from the vault key, so files are separated from each other. The vault database is encrypted too, with the SQLCipher library.
Your recovery code is a second, independent way to unwrap the vault key. It is made on your phone and shown once. We never see it.
Independent review
Ciphergrove has not yet had an independent security audit. If you find a security problem, please tell us.
Tips
- Write your recovery code down and keep it somewhere safe, away from your phone.
- Make an encrypted backup file now and then, and store it away from the phone.
- Use a screen lock on your phone, and keep your phone’s software up to date.