Local storage on mobile
Four storage options (preferences, private files and cache, SQLite database, key vault): picking the right one for each piece of data, knowing what survives closing, clearing the cache and uninstalling, and never writing a secret in plain text.
- 21 cards
- 5 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
- Understand
A few cards from the deck
Preferences: what is it?
Show the answer
A small app space that stores simple key-value pairs: a setting, a number, a short text.
SharedPreferencesorDataStoreon Android,UserDefaultson iOS: handy for a theme or a last tab, unsuited to numerous or related data.The user taps "Clear cache" in the app's settings. Which of these pieces of data disappears?
- The downloaded thumbnails
- The dark theme chosen in the app's settings
- The notes saved in the SQLite database
- The documents the user created in private storage
Show the answer
The downloaded thumbnails
Only the cache folder is emptied. Preferences, database and private files live elsewhere and only go with "Clear data" or uninstalling.
An access token is never written in plain text to preferences or a file: it is protected by the system's ….
Show the answer
An access token is never written in plain text to preferences or a file: it is protected by the system's key vault.
Preferences and private files are readable in plain text on a rooted phone or in a backup. The vault holds the secret, or the key that encrypts it, without ever handing that key out.
Private storage: what is it?
Show the answer
A folder reserved for the app, which other apps cannot read and which is erased with it on uninstall.
That is where the app's files go: working documents, database, drafts. It survives closing the app, not uninstalling it.
An access token, stored as is in the preferences, is read in plain text by a tool on a rooted phone. What should be done?
- Rename its key in the preferences so that it cannot be guessed
- Move it to the cache folder, which other apps cannot read
- Also copy it to a private file, to have a backup
- Protect it with the system key vault and keep nothing in plain text
Show the answer
Protect it with the system key vault and keep nothing in plain text
On a rooted phone, every app file is readable, whatever its name or folder. The vault holds the token, or the key that encrypts it, without ever handing that key out: the stolen file no longer shows anything readable.