Free weekly email: the week's new posts, videos and one tip from the books, every Sunday. Get it free →
Homelab the Right Way

Home › Posts

Don't keep secrets in Auto Backup

The backup rules file excludes device-bound files, but you must also set android:allowBackup="false" to prevent cloud backups from moving ciphertext.

· 3 min read · androidbackupssecuritykeystoredatastore

Don't keep secrets in Auto Backup

Most developers assume that because they are using a secure key generation system, their app is safe. They write the code to pull a key from the Android Keystore, encrypt a token, and store the result in a private file. They then look at the Android documentation for Auto Backup and see that it only copies files from filesDir and getExternalFilesDir(). They conclude that the ciphertext is safe because it sits in a private directory. This is the trap. The platform treats the private directory as a black box, but Auto Backup ignores that rule and sweeps the ciphertext into the Google Drive backup as soon as the key is generated inside the Android Keystore.

The "Data That Survives" chapter opens its backup section with exactly this distinction, under a heading that sums it up: two kinds of transfer, two sections in one rules file. This post covers the data extraction rules, what the cloud backup actually includes, and the setting that stops it from moving ciphertext.

The trap: ciphertext travels in the cloud

The Android Auto Backup feature copies most of your app's private files to the user's Google Drive, protected by their Google Account credentials. According to the guide, the backup is end-to-end encrypted on Android 9 and higher using the device's PIN, pattern or password. The default behavior includes shared preferences, files in filesDir, databases and files in getExternalFilesDir(). It excludes the cache directories and getNoBackupFilesDir().

For an offline-first app that is mostly good news: unsynced notes can survive a lost phone. It also means your database restores onto a new device, which affects sync state, and that anything secret or device-bound travels too unless you exclude it.

The trap is that the Android Keystore key material never leaves secure hardware where available, but the ciphertext it produces does. A Keystore key does not travel in backups or device transfers, so ciphertext restored onto a new phone cannot be decrypted there. If you rely on Auto Backup to move the ciphertext, you are effectively sending the secret to the cloud without the key.

The fix: disable Auto Backup for the app

The chapter provides a single, direct setting to close this gap. The guide warns that for apps targeting Android 12 or higher, on some manufacturers' devices that disables cloud backup but not device-to-device transfer, so the rules file is the more precise tool. The first step is to set the manifest attribute to false.

The guide advises setting this attribute in the `` tag.

The fix: exclude device-bound files from the rules

Even with android:allowBackup="false", you should configure the data extraction rules file. This file controls what goes to Google Drive and what happens during a direct phone-to-phone move. For apps targeting Android 12 (API 31) and higher, the rules live in a data extraction rules file referenced from the manifest. The guide also tells you to keep a second, older-format file (android:fullBackupContent) for devices running Android 11 and lower.

The manifest entry for the application tag references these files.

<application
    android:dataExtractionRules="@xml/data_extraction_rules"
    android:fullBackupContent="@xml/backup_rules_legacy">

You then define the rules in the XML file. The chapter presents a complete example that includes the cloud backup section and the device-transfer section. The example lists the database and settings file to include, but explicitly excludes the secrets file.

<?xml version="1.0" encoding="utf-8"?>
<data-extraction-rules>
    <cloud-backup disableIfNoEncryptionCapabilities="true">
        <include domain="database" path="field-notes.db" />
        <include domain="file" path="datastore/settings.json" />
        <exclude domain="file" path="datastore/secrets.pb" />
    </cloud-backup>
    <device-transfer>
        <include domain="database" path="field-notes.db" />
        <include domain="file" path="datastore/settings.json" />
        <exclude domain="file" path="datastore/secrets.pb" />
    </device-transfer>
</data-extraction-rules>

The exclude tag for the secrets file is the precise command that enforces the rule. It tells the system to keep the ciphertext out of both the cloud backup and the device transfer. The disableIfNoEncryptionCapabilities="true" attribute on the cloud-backup tag skips the backup when it cannot be end-to-end encrypted, adding another layer of protection.

Checklist

  • Set android:allowBackup="false" in the manifest to disable Auto Backup.
  • Create a data extraction rules file referenced from the manifest.
  • Use `` to stop ciphertext from traveling.
  • List every file that should travel using `` tags.
  • Remember that a database restored from backup carries its dirty flags and server_version numbers, so test the restore onto a fresh install.

More articles