[Android Apps and Games] pulser_g2:
I saw this on the portal, and figured it was worth a look at, since it's claiming to be secure, and is closed source... Closed source security software is always something you should be very skeptical of, due to Kerchoff's Principle. It basically states that a cryptosystem should be secure, even when the entireity of it is known to the attacker, with the exception of the key. Anyway, alas it wasn't necessary to have the source code to break this app... Let's take a look at the claims

Very valid concern that people have. Lots of people do. This sounds good so far.

Ooh, military grade encryption... Let's start counting how many times this is claimed... That's 1! This sounds interesting, except that hiding is not encryption. Hiding is a form of steganography. Encryption is the algorithmic modification of data, based on a key, so it can't be recovered without that key. But anyway, let's keep on going - this claims to be one of the "most secure encryption algorithms" ever... That's a bold claim, though I suspect this refers to AES.

Another big claim... Let's see shall we, rather than getting ahead of ourselves?

Oh wow, this is good for corporate users, and it's military-grade crypto (count 2!)... That's a bold claim... This really must be ULTRA secure...

Count 3 now... They are REALLY confident about their encryption here!

So... guesses as to how long it took me to break this? Under 3 minutes...

Here's how (instructions for Linux)... Install the app, set it up with an account. Make a vault, and put a file into it. Encrypt it up. Close the vault and leave the app.

adb pull /sdcard/Andrognito2/

(now you have all the files from the SD card directory on your PC)

sqlite3 Backups/files_VAULTNAME_new

SELECT * FROM FILES_MAIN;

1|ADG_mine|com.codexapps.andrognito.apk|4bd074e9-4225-4252-899d-7f5cea989aec|/storage/sdcard0/com.codexapps.andrognito.apk|other|false|5760734

(this shows you the raw filenames and paths of the encrypted files... Not so hidden after all? The "hidden" filename was the 4bd0... part, and the original filename was this app's APK name)

OK, so that's just a leak of the filename, right? Wrong...

type ".quit" to exit sqlite

sqlite3 Backups/vault_VAULTNAME_ne

SELECT * FROM VAULT_MAIN;

You'll see something like this:

1|ADG_mine|mine|7979|2222|false|true

Yeah... 2222 was my PIN... "mine" was the vault name... Oh dear!

Ehhh... no thanks... A 5 star rating? You'd be lucky to NOT get legal summons for false representation and mis-selling of this tool...

Also, the encryption here is woefully weak, since it's based on a 4 digit PIN... Meaning 10,000 possible combinations of password. There's an option to wipe your data after N wrong passwords... So just dump the files off, and try it many times... Come on...

I didn't even look at the encryption used, since the above didn't fill my with much confidence at all! Why bother, when the PIN is there to see for all? I hope the encryption keys for the files are actually encrypted with the PIN (not that it will help, since the PIN is low entropy).

Folks... Be careful here... Just because something says "military grade security" and looks flashy, doesn't make it secure... Even if you say this is secure three times... This is simply NOT secure... Do NOT use it. It can't be secure, using a 4 digit PIN, unless it uses such a lengthy key derivation function to make it impossible to brute force 10,000 PINs... To make that impossible, it would mean unlocking the vault would take several days... (someone can wait a few years to get your files if they are valuable commercial documents).

OP, you should be ashamed at your claims of this being secure, and the "most secure" and whatnot. Very, very ashamed.
​