Hacker News Reader

WhatsApp messed it up particularly bad, but it's not the only example. The point is that there was no private access to the SD card. If you had large files that did not fit on the internal storage, using the shared external storage was the only alternative. Developers abused that and ended up putting all sorts of private data on the SD card.

View on HN

Lets try to not confuse "external storage" (effectively a partition on the emmc, but mounted under /sdcard for legacy reasons) and an actual SD card.

Removable storage, SD, USB, etc, was moved from external_storage to media_storage with Android 3.1.

Note that external_storage was still about putting files in an area readable by any and all apps that had read_external_storage permission.

In other words, the change would do jack all to safeguard against idiots like the whatsapp app devs.

> The point is that there was no private access to the SD card.

Sure there was! Simply generate a random key, store it in the (small) private storage area, and use it to encrypt whatever you want to write. Instant private area!

Reply on news.ycombinator.com