Core Apps » Secure Reader

I hadn't thought about the privacy issues of OPML import/export, good you brought it up :). There are a number of use cases:

• import/export to migrate from one app to another
• export to back up current feed collection
• import to restore feeds on new device
• export to share with a friend

My guess about replace vs add is that OPML importing adds. But lots of apps support OPML, so it would be easy to see what people are doing.

I think for import, the threat would be if somehow someone sent an OPML file that caused either an exploit of Courier or a data leak to help deanonymize the user. As long as the import process is never transparent (i.e. the user is prompted on incoming import, or the user must initiate the import), then I think it is not a big risk. If the user wants to add those feeds, they'll do so manually anyhow.

As for export, the risks there are greater since the list of feeds could be sensitive information. Perhaps there is a way to "stream" the OPML straight from Courier's IOCipher store?

The largest privacy/security issue surrounding import/export is the ARTIFACT (file) required to do so - an unencrypted artifact is required and this is dangerous in the geographies Courier (and especially its variants) supports.

I'm going to conceptually separate "export" and "share". Courier has a secure share mechanism - requiring physical proximity - and we'll continue with that, adding "share my feed list" to the existing "share a feed" and "share an article" capabilities. That mechanism does indeed "stream" (Courier to Courier). We'll think of export as "Courier to Non-Courier", and that raises the security issues.

As for ADD vs REPLACE, this needs to be considered in light of our new strategy regarding the feed list. Currently, Courier offers a few feeds by default and it is difficult to add feeds. We're improving the "add feed" capability in the coming release in ways that will support (a) a large number of default feeds and (b) ease of adding feeds - implying each user's feed list will be long, and will contain SUBSTANTIALLY OVERLAPPING feed addresses. For example, user A's feed list might contain 100 entries, of which 2 are different from user B's. Therefore, by the time THIS feature becomes available, what we'd want is DIFF+ADD (rather than ADD only or REPLACE only).

Scenarios: Given the scenarios you mention, I think we need to consider as part of this feature "import with BURN" and "export with BURN" (meaning killing the import/export file from storage after use).

Definitely DIFF+ADD, no use in having multiple copies of the same feed. Perhaps there will be issues with the same feed having different configs, like "include comments"? To handle that, there will need to be some clear behavior, probably one of these:

• keep current config
• replace current config with incoming config
• prompt user to choose current or incoming

Courier-only export makes sense for now. As for supporting OPML for the general user, I think that import from anything is more important that exporting to anything. I think it makes good sense to start with implementing import any OPML, and secure export only to Courier.

I just had a thought: using TrustedIntents and the OpenPGP Android API, Courier could have a "secure backup" feature that would be quite tight. Basically, it would only export to a trusted encryption app (our GPG or OpenKeychain, for example). That app would then encrypt it to the GPG key.

This could also be done using standard AES symmetric encryption, using either the same password or the same cacheword key as the encrypted storage.

I like the idea of sharing to a trusted encryption app. That approach "exports" the entire question of where the file ultimately ends up and who uses it because from our app's perspective we've just created a safe file.

That said, we'll have to offer the possibility of sharing to other apps without encryption as well.

Thus, I guess a "fallback" approach is warranted: (1) try TrustedIntent to see if there are apps that will share that way, (2) fall back to normal Android Share Intent if none.

UX-wise, I had prototyped the possibility of having a Share/SEND menu that sorts the trusted apps to the top. That might not highlight the difference enough, but I just wanted to say I think it is a possibility.

Any news.
Courier looks fine, but manually importing each feed is a drag.

No news yet - feed import/export is in our roadmap and a stretch goal for our late-summer (2015) project deadline. Arriving earlier, however, will be a feed "finder" which will make it unnecessary to type in feed URLs of feeds you desire.

The feed finder is definitely good news, but it won't cover all of the use cases that OPML import does. For example, there are some feeds that have subscriber info in them. I pay an annual fee to Ars Technica to get access to the full text feed, and that requires a custom, per-user feed URL.