Chapter 9 Local Data

Platform specifics

As mentioned, the SecureStorage API makes use of each of the platform-­ specific APIs to handle the actual storage of the data you pass in. It is worth noting that the implementations for each individual platform are different and may change in the operating systems but SecureStorage will leverage whatever is in the operating system and therefore will always be the most secure option. This section explains how.

Android

The data you pass in is encrypted with the Android EncryptedSharedPreferences class, from the Android Security library, which automatically encrypts keys and values using a two-scheme approach:

\1.\ Keys are deterministically encrypted, so that the key can be encrypted and properly looked up.

\2.\ Values are non-deterministically encrypted using AES-256 GCM.

The Android Security library provides an implementation of the security best practices related to reading and writing data at rest, as well as key creation and verification.

Since Google introduced Android 6.0 (API level 23), the operating system offers the ability to back up the user’s data. This includes the Preferences and also the SecureStorage that .NET MAUI offers. It is entirely possible and in fact I recommend that you disable this backup functionality when using SecureStorage.

In order to disable the auto backup feature, you need to set the android:allowBackup to false in the AndroidManifest.xml file under the

Platforms/Android folder. The resulting change should look something like the following:

293

Chapter 9 Local Data

<manifest ... >

...

<application android:allowBackup="false" ... >

...

</application>

</manifest>

iOS andmacOS

Data passed into SecureStorage on iOS and macOS is encrypted through the Keychain API. To quote Apple,

The keychain is the best place to store small secrets, like passwords and cryptographic keys. You use the functions of the keychain services API to add, retrieve, delete, or modify keychain items.

For further reading, refer to the Apple documentation at https:// developer.apple.com/documentation/security/certificate_key_and_ trust_services/keys/storing_keys_in_the_keychain.

In some cases, keychain data is synchronized with iCloud, and uninstalling the application may not remove the secure values from user devices. I have certainly observed this in some applications I have built, so it is best to plan around this possibility.

Windows

SecureStorage on Windows uses the DataProtectionProvider class to encrypt values securely. The .NET MAUI implementation allows for the data to be protected against the local user or computer account.

For further reading, refer to the Microsoft documentation at

294

Chapter 9 Local Data

https://docs.microsoft.com/uwp/api/windows.security.

cryptography.dataprotection.dataprotectionprovider?view=wi nrt-22621.

Viewing theResult

Now when running your application you will see that not only does the last board that you create get loaded back up but it also shows the widgets you previously added. Figure 9-2 shows an example of the results.

Figure 9-2.  The application loads back up and shows the previously added widgets

295