SonderVault 1.5

SonderVault 1.5

A new look. SonderVault now shares its design with SonderShield: a black page, one
accent colour, bold Unbounded headings and DM Sans text, rounded cards and pill buttons.
The vault opens on a header with your item count and All / Photos / Videos / Files chips,
with your photos on a panel under the blue swoosh. Picking items turns the top bar blue
and frames each picked photo. Settings is split into numbered sections, and a new Look
section lets you choose Default, Light, System or Material You, and an accent colour.

The unlock screen still shows no name, logo or heading.

Security

• Every password check now waits like the unlock screen. The prompt that asks for your
  password before files leave the vault, and the duress password screen, could be used to
  guess the main password with no wait at all.
• Names from outside the app are cleaned. A shared file made by someone else could
  carry a file name that, when put back on Android 9, wrote outside the gallery folder.
• Damaged or hostile shared files are refused before they are read. A file asking for
  a gigabyte of memory, or listing entries outside itself, no longer crashes the app.
• A duress wipe overwrites the index that holds every item key before deleting it, and
  removes the fingerprint's copy of the real key.
• Saving the index can no longer destroy it. A failed save leaves the previous index
  exactly as it was.
• Copying the six-word code marks it as sensitive, so keyboards do not keep it, and
  clears it from the clipboard after a minute. The keyboard no longer learns the code as
  you type it.
• Leaving the app from the file picker now locks the vault within two minutes instead
  of leaving it open.
• Taps through another app's window drawn on top are ignored, so an overlay cannot
  trick you into pressing a button or typing your password.
• Fewer keys left in memory. Locking zeroes every item key, not just the master key;
  the index is read without turning keys into text; decrypted blocks and password bytes
  are wiped as soon as they have been used.

Nothing about how your vault is stored has changed. Update over the installed app — do not
uninstall first, which deletes the vault.

Requires Android 9 or later.

SonderVault 1.1

SonderVault 1.1

A wrong password now costs time. Three attempts are free, because typing a password
wrong is ordinary. After that every further wrong one doubles the wait — fifteen seconds,
then thirty, then a minute — up to a ceiling of fifteen minutes. The unlock screen shows
how long is left and nothing else: not how many attempts have been made, not how many are
left, not whether any of them were close.

This slows down a person holding the phone. It is not a defence against someone who has
copied the app's storage off a rooted device and is attacking it elsewhere, where nothing
in the app is running — Argon2id at 64 MiB is what makes that expensive, and it has not
changed. The wait is enforced where the vault is opened rather than on the screen that
asks, so knowing the password does not let you spend it early.

Your fingerprint is not affected. It is neither blocked by the wait nor counted against
it, and using it clears the count. So does a duress password.

Fixed

• An import that was still finishing when the app went to the background could damage
  the vault's index. Locking wipes the index key immediately, and anything still writing
  at that moment wrote a file that the real key could no longer read. The index holds
  every file key in the vault, so this was the whole vault rather than one photo.
• Items could go missing from the index. A screen full of tiles rebuilding their
  thumbnails writes the index once per tile, and two of those — or one of them and an
  import — could overwrite each other.
• Turning fingerprint unlock on and then cancelling the prompt left it broken. The
  offer stayed on the unlock screen and failed every time, until the switch was turned off
  and on again.
• Locking the app did not take the master key out of memory, only out of reach.
• The key slot file is now written and forced to disk before it replaces the old one, so
  losing power partway through cannot leave it empty.
• Files above 2 GB could be cut short when read.
• A crash report could record the name of a file that had failed to import.
• Backups and vaults written by a future version stay readable by this one.

SonderVault 1.0.1

A small fix.

• The suggestion to turn on fingerprint unlock can now be turned down for good. It has
  a Never button beside Turn on and Not now. Turning fingerprint off in settings used
  to mean being asked to turn it back on every time the vault was opened, which is the app
  arguing with a decision already made.

Fingerprint unlock can still be switched on at any time from Settings; saying never to the
suggestion does not take the feature away.

SonderVault 1

The first release.

A private space on your phone for photos, videos and files. Everything is encrypted on
the device and stays there.

• Import photos, videos and files. The original is removed from your phone, not just
  hidden in a folder.
• Open with a password or a fingerprint. The password is the only real key.
• A duress password that opens a different set of photos you chose, and can destroy
  the real vault as it opens. Nothing in the app hints that a second vault exists.
• Share as one encrypted file with its own six-word code, shown as a QR. Scan it or
  type it. Backing up is the same thing, to yourself.
• View what you store. Photos zoom, videos play and scrub, PDFs and text files open —
  decrypted as they are read, never copied out to a temporary file.
• Screenshots, screen recording and the recents thumbnail are blocked throughout.

Argon2id at 64 MiB for the password, AES-256-CTR with HMAC-SHA256 on every block
of content, AES-256-GCM for key wrapping. No INTERNET permission, so nothing in the
app can send anything anywhere whatever the code says.

Two things worth knowing before you rely on it. A six-word code cannot be reset —
there is no copy of it anywhere and no recovery route in the format. And if cloud photo
backup is on, a photo you hide is still in your cloud account; SonderVault removes it
from the phone and has no way to reach the copy there.

Requires Android 9 or later.