Android Developers Blog

abcd_f, I'm not part of the Telegram team, nor am I a cryptographer. However, I do support these guys, and for the last 3 days I saw the Telegram team diligently reply tech questions in Twitter, HN and blogs. I saw them collect questions from security experts and put up FAQs based on them http://core.telegram.org/techfaq or http://core.telegram.org/contestfaq as well as update the obscure parts of their documentation.

>> Perhaps consider offering an alternative crypto suite based on standard protocols? In parallel with what you have. Just reuse an existing crypto framework and redo transport layer to your needs.

Again, I am not cryptographer. But as a person who wants his data to be secure I don't see anything wrong with different teams trying different approaches. I 100% agree that people crave a good encrypted communication system, but I'm not sure it can be achieved in a world where everybody uses similar methods. What if some of the common "best practices" are intentionally promoted in the crypto-community as the best ones exactly because they contain flaws and backdoors?

Please allow me to give you an example of something that could be just that.

The Telegram team was criticized by some NH critics for their custom auth key exchange protocol. People asked – why take a random value from server and a random value from client and combine both with a creepy function? Why not, e.g., just generate a random value on the client and use RSA instead? Well, the answer is simple…

W3C has good basic info on what internationalization and localization each mean:
http://www.w3.org/International/questions/qa-i18n.en

Many developers will make a start by:

- Internationalizing their strings. In the case of Android, this is typically achieved by moving hard coded strings from the code to a separate strings.xml file

- Localizing those strings: Having one or more professional or volunteer translators create localized versions.

Different platforms use different file formats for localized strings. For example, a lot of web frameworks use .po files: https://www.drupal.org/node/1814954

Best practices:

- Don't re-invent the wheel. Use libraries provided by others, e.g. https://developers.google.com/international/i18n

- Decide which languages you will want to support over the long term, and think about what it will take for you to be successful (e.g. local support staff, marketing effort, ...)

- Don't stop at translation. Do all the other stuff (number/date formats, support for right-to-left languages)

- Of course, use UTF-8 or UTF-16

- Choose the right platforms/partners for translation. Google offers a service targeted at Android apps[0] and there are crowdsourcing platforms which may work if your users are willing to translate for you [1][2]. These work for web apps as well as native.

- Get a native speaker to do QA on the output (on the app itself, not just by looking at the strings file)

[0]…

A good lunchtime read, thanks. A couple of misleading topics and word of advice from our own experience [0] of starting Android development after years of iOS development:

- Google seems to moving away from Activities in favor of Fragments (can someone confirm this?) so we'd recommend a Fragment based design pattern;

- App navigation paradigms seem to be evolving quickly, with Google recently introducing Navigation Drawer as a standard [1], among others;

- Choosing the navigation paradigm first seems to important as these seem to be Fragment based, using Bundle objects to share data between Fragments;

- Use Android Studio [2] because it seems a) Google is going to standardize on this, and b) the navigation paradigms are offered as app template options and can be a good starting point presumably with 'blessed' Fragment design patterns.

Good luck!

[0] http://blog.fieldforceapp.com
[1] http://developer.android.com/design/patterns/navigation-drawer.html
[2] http://android-developers.blogspot.com/2013/05/android-studio-ide-built-for-android.html

His work also highlights the lack of support given by Google for backwards compatibility. Stuff like action bar (one of the biggest new UI changes in 3.0+) backwards compatibility is essential if you design your app around the new patterns and guidelines. Their official recommendations for having an action bar in 2.3 and below are:

1. Reimplement almost the whole action bar on 2.3 and below by building on top of their "ActionBarCompat" example which is very minimal and only supports menu items - if developers take this approach, there's going to be a lot of inconsistent action bars out there.

2. Just forget the action bar on older versions of Android (http://android-developers.blogspot.com/2012/01/say-goodbye-to-menu-button.html), which is terrible advice - you can't just pretend that it never existed when the whole app is designed around it. Thankfully they don't believe this themselves since all their apps have some sort of action bar implementation on older versions too.

The hardware/software split is too simplistic a view. The companies have their various strengths and weaknesses. For example, the graphics stack on iOS embarrasses Android's. It took how many years and how many hardware advances before flagship Android got scrolling as smooth as the first iPhone?

Another example: Google released Renderscript in early 2011 (http://android-developers.blogspot.com/2011/02/introducing-renderscript.html) only to deprecate it a little over a year later (https://developer.android.com/about/versions/android-4.1.html#Renderscript). We can cherry pick examples all day long, but the bottom line is that each company excels at certain things.

It's interesting how Samsung is basically stuck to Google at this point. I'm sure they'd love to switch to their own Bada or Android fork and capture more of the profit, but Samsung is absolutely abysmal at software.

This link adds nothing to the original content, which can be found at [1].

Neither mentions that this will not break apps which were built for an older OS and are simply run on KitKat. In order the the app to break the developer must specifically change the API their app targets to KitKat without changing which key generation algorithm they use. I wish the docs [2] mentioned this change, but presumably if you're developing apps you'll be following the blog.

It would be very cool, and it's certainly within Google's capabilities, if Google emailed developers using PBKDF2WithHmacSHA1 to notify them. That would close the loop and prevent anybody from being caught by the breaking change.

[1] http://android-developers.blogspot.com/2013/12/changes-to-secretkeyfactory-api-in.html
[2] http://developer.android.com/reference/javax/crypto/SecretKeyFactory.html