Question

I’m looking to securely send a file as an email attachment on Android (the file contents are private to the user). From all the posts I’ve read it appears that it’s only possible to send a file as an email attachment after creating it on the SD card and providing read access to all (other apps). This appears to be inherently insecure in terms of other users on the device accessing this data (assuming multi-user device).

Is there any way to do this securely on Android?

Answer 1

From all the posts I’ve read it appears that it’s only possible to send a file as an email attachment after creating it on the SD card and providing read access to all (other apps).

An email program has to be able to read the attachment in order to be able to send the attachment. AFAIK, this is true on every operating system ever created in human history.

That may not necessarily require you to have the file be on external storage (what you refer to as “the SD card”), though I have not tried sending an email attachment using, say, a ContentProvider to make the attachment available to other apps. Regardless, you have no good means to limit the read access to only the email client, though you can make access unavailable after a period of time (e.g., after you believe the email has been sent).

This appears to be inherently insecure in terms of other users on the device accessing this data (assuming multi-user device).

Android is not a multi-user operating system at this time.

Is there any way to do this securely on Android?

Send it yourself, by writing your own email client, perhaps using the JavaMail for Android port that is floating around.