Feature Request: Security and trust improvements

[Kayett]

Hi! First, thank you for all the work you put into Ava. I really like the project and have it running on 5 Lenovo M10 tablets with the charging bases, and it works quite well. The intercom, and Mod Store make Ava very unique.

I am planning to use Ava on even more devices in my home, but I found a few security areas that I wanted to bring up. I am sharing these because I really want to see Ava become even better, for even more people.

The most important improvement for me would be ESPHome API encryption/authentication using the standard Noise PSK system. The documentation mentions Noise encryption, the current server code appears to accept unencrypted ESPHome connections without requiring a key; not a huge deal when the device is airgapped but could help others.

Other improvements I would really appreciate:

• Protect exported Android controls like mic mute/unmute, wake, and service controls from other installed apps.
• Download updates directly from GitHub instead of proxied through ghfast.top.
• Add a GitHub Actions release build so users can clearly see which source commit produced each APK.
• Move release signing passwords out of the Gradle file and into secrets/environment variables.
• Make Microsoft Clarity analytics optional or opt-in.

I know this is a lot. I am requesting it because I really like Ava

Thank you again for maintaining this project. I know Ava is quite a large project. I really appreciate the work you are doing.

p.s. a search feature in the settings would be appreciated as the feature set only grows wider!

[knoop7]

Hi, thank you for your encouragement and warmth; I will continue to improve the features related to Ava.

I’d like to start with a summary so you can see at a glance which of the points in my lengthy explanation I plan to implement:

1. ESPHome Noise PSK: implemented locally; interoperability testing is in progress for the next patch.
2. Exported Android controls: confirmed; privileged actions will be protected before the next release.
3. GitHub downloads: GitHub will become the default, with regional mirrors used only as fallback. Integrity verification will remain mandatory.
4. Release provenance: under review; I will publish a clear decision separately.
5. Signing credentials: confirmed and being moved out of Gradle. This does not change the signing key or affect upgrades.
6. Microsoft Clarity achieve
7. Settings search: accepted for a later UI patch.

Regarding cryptography, I am indeed still researching; my personal expertise is limited here, so I rely on ChatGPT to help solve certain problems—specifically, the technical bottlenecks I faced during the initial implementation. Furthermore, ensuring Ava remains secure against external network intrusion is a critical requirement for the next stage of development.

I plan to build in a VPN relay/traversal mechanism so that other similar in-vehicle systems can also use it. I will implement the cryptography first and then enhance capabilities later; the ESPHome key method will be implemented directly in version 7.2, which you can simply install as an upgrade.

Download updates directly from GitHub instead of using the ghfast.top proxy.

Regarding this issue: users in certain regions were unable to download the app normally, which is why the mirror site was used. Additionally, version 7.1 was a rushed release intended to fix some legacy issues, but this caused concurrent access problems across all regions—leading to GitHub concurrency locks that prevented downloads. I will release a patch in version 7.2 that addresses this and includes the requested feature.

Add GitHub Actions for releases so users can clearly see which source code commit generated each APK.

Regarding the source code: I actually really want to release it. I previously thought keeping the software closed-source was fine, but everyone's encouragement has made me reconsider; I genuinely want to go open-source.

However, there is currently a lot of competition and mutual copying, with everyone acting in their own self-interest to maximize gains—an outcome I don't want to see. I’m going to wait a bit—until the competition cools down or I find a better approach. Last week, a flood of similar coding tools appeared. Alternatively, I might find a way to open-source just parts of the project, which could also be a better outcome.

Move the release signing password from the Gradle file to secrets or environment variables.

The main issue lies in ensuring a seamless upgrade experience for existing users—especially since the influx of new users is limited and the project relies heavily on the trust the community places in Ava. This makes changing certain aspects difficult.

For instance, I’ve wanted to change the package name because the current one looks too rudimentary. However, since Ava originated from the original project, I committed to retaining the "Ava" branding rather than switching to a generic name like "Kiosk." Consequently, the need for seamless upgrades forced me to compromise on some of these changes.

What Ava currently protects is not a specific algorithm, but rather the entire methodology of "encapsulating a complete system within a minimal package" and certain C++ logic—an area that has required a significant amount of research time.

Make Microsoft Clarity analytics optional or opt-in.

I will implement this feature in the current version—thanks for the reminder; it is indeed an issue. I plan to strip it out immediately in version 7.2. I should explain that the tracking was primarily intended to monitor user growth, as raw download counts don't tell the whole story for Ava; we also need to track geographic distribution. This ties back to the issue mentioned earlier regarding Ava being unavailable for download in certain regions.

Regarding the floating window: most similar apps don't use this approach; they usually just wrap a WebView internally. If a developer injects extra monitoring code into that wrapper, user privacy cannot be truly guaranteed. Furthermore, such apps can often "see" other devices on the same network. The floating window design helps prevent external privacy leaks. Additionally, I’ve moved the screen-capture functionality into a separate "mod" available in the store, making it an optional feature. This better ensures a smooth user experience and enhances security.

PS: It would be great to add a search function to the settings, as the feature set keeps growing!

You're absolutely right; that would help users find things faster. I’m currently considering the best way to implement the search bar. Indexing can sometimes cause lag during searches, which is why I abandoned the idea initially—I was concerned about performance on low-end devices. I’ll give it some more thought on how to implement it properly. Thanks for the suggestion; I’ll look into adding this incrementally in a patch for the current version.

[knoop7]

https://github.com/knoop7/Ava/releases/tag/0.7.3