Encrypted SD card on android Marshmallow showing filenames?

[enesha]

So I recently f*ed up my phone and needed to re flash the os from kdz. The down shot of this was that I would lose access to all of my encrypted files. My bad tho, I soft bricked it by being stupid so losing those files was my fault and I made peace with it lol.

My issue is what happened when I was done with the reinstall. When I looked at the sd card from file manager or by connecting to a pc, I could still see the files! I could not open the video files or pdf or whatever, which would be expected since the encryption key was lost the the universe. But I can't help but wonder WHY the files were still visible? I mean, yes, the contents were scrambled but you could still see them. When I want my files hidden I want them to be totally gone when they are lost in the ether like this. I have many files I want/need to keep private. If someone gets my card and can even see the file names, it could cause me significant issues.

Is this really how the encryption is supposed to work? That seems like a pretty hefty security flaw. Can anyone else tell me if it does that for them too, so I know it's not me And if it is universal, is it by design or is there something that can be done to change how that works?

Thanks

 

[ManiacJoe]

What you are seeing is the difference between "whole disk" encryption and encryption of the individual files.
Two different ways of doing file encryption, each with its pros and cons.
One advantage of encrypting the individual files is that the default file system still works with all its features. This could be important for the low CPU power of phones.

 

[enesha]

Ah - I sort of thought that might be the case. For some reason I assumed when you tell android to encrypt the sd card, it did just that and not the files by itself. Something like my encrypted disk on my mac where it is completely unavailable unless you enter the password. I'm not really happy about the android way...I am paranoid about some security things or the govt tracking me or something lol. If you can see the files , even just the names, you can maybe start to put together where i've been, what I'm doing, who I've spoken with. Shady business, and less than the security they, if not promised then implied lol

They could have just made it like an encrypted container file still formatted as...what they use fat right? just inside the container so that without the password it's impossible to not only read the files, but be sure that any files exist at all. Ah well, thanks for the reply. Lets hope for better security in the future

 

[enesha]

Wow things keep getting worse for Android FDE. I figured that I would reply to myself on here so that I could pass on this little gem that I ran into a few hours ago. Looks like it's not secure anyway lol Wow

Android’s full-disk encryption just got much weaker—here’s why | Ars Technica