[APP][2.2+] MiXplorer v6.x Released (fully-featured file manager)

[IronTechmonkey]

Solid explorer can access MediaFire

It is unclear why you are sharing that because it seems that MiXplorer can access MediaFire as well, via "Add storage". If there are problems configuring it you could share details and logs to troubleshoot.... Or does this pertain to the recent discussion about Google declarations?

 

[daywalk3r666]

It is unclear why you are sharing that because it seems that MiXplorer can access MediaFire as well, via "Add storage". If there are problems configuring it you could share details and logs to troubleshoot.... Or does this pertain to the recent discussion about Google declarations?

View attachment 5820085

I posted this because of this post

[APP][2.2+] MiXplorer v6.x Released (fully-featured file manager)

[APP][2.2+] MiXplorer (full-featured file manager) Hello everyone! My name is Hootan. I work on XDA in my free time and this file explorer is my favorite Android project! MiXplorer mix of explorers (SD, FTP, Lan, Cloud and other storage...

forum.xda-developers.com

Maybe this can help to fix the data privacy issue

 

[HootanParsa]

Solid explorer can access MediaFire

Thanks but I checked the codes and MediaFire also cannot be the problem.

@J.Michael
Now I think it's because of Mail.ru cloud storage. The only feature which is asking for email address and it's sending it off user's device. Probably Google bots have detected MiX is sending email address.

 

[IronTechmonkey]

@J.Michael @IronTechmonkey
Here they're saying:
“Collect” means transmitting data from your app off a user’s device:

Provide information for Google Play's Data safety section - Play Console Help

In July and October&nbs

support.google.com

Now I remember I read these resources last year and said no to collect and share question. I think they read MiXplorer's policy where I said this app needs username/email-password to login to some cloud storage which don't support oauth2 like MediaFire and Mail.ru. So MiX is posting email/password off device but posting directly to the user's account. I don't remember any other feature in this app asks for user's email address.

Edit: I checked the related codes to MediaFire storage. MiXplorer is sending the hash of email and password. I think Google developers are messing with me!

From the start this has seemed like it might relate to email or cloud credentials that are used in legacy connections with credentials sent from the device though a network, as we've seen since that update in the Google terms, a wave of change where providers "intercept" (for lack of a better word) the credentials on the device which would be exempt.

I'm trying (unsuccessfully) to stifle a cynical rant about how Google is merely forcing another level of exclusivity as well as more dependence on their services and internet access in general. It's like tendrils reaching through these authentication methods into our devices. Fresh Tendrils (Soundgarden, anyone?))

 

[IronTechmonkey]

I posted this because of this post

[APP][2.2+] MiXplorer v6.x Released (fully-featured file manager)

[APP][2.2+] MiXplorer (full-featured file manager) Hello everyone! My name is Hootan. I work on XDA in my free time and this file explorer is my favorite Android project! MiXplorer mix of explorers (SD, FTP, Lan, Cloud and other storage...

forum.xda-developers.com

Maybe this can help to fix the data privacy issue

Ahh, got it, and it lines up with previous hypotheses. There are so many people who would present a question about configuring the cloud account that way that I was confused by your post (but the dev was not). Thanks for clarifying. Also, it seems just now in the middle of this exchange the developer has a eliminated MediaFire as possible culprit and found another potential suspect.

 

[IronTechmonkey]

Putting aside my utter disdain for the author of "from off a user's device" there is the exception

You too? LOL Well, I don't have disdain for the author (unless it's Google) but I do for the copy, and on the serious side that led me to wonder if that was actually Google's wording or if it was someone else paraphrasing which in turn led me to doubt some of what I was reading there. Pardon the grammar OT.

 

[marciozomb13]

Better remove MiX Silver from Play Store and just publish it as a donate key. A kind of "thank you" app. Too much headache.

 

[HootanParsa]

I submitted an appeal and Play answered.
Yes, not only Mail.ru, even Mega has a pre-login which needs email address.
I'm not sure if there is any other way to login to these clouds.

 

[Logan]

I submitted an appeal and Play answered.
Yes, not only Mail.ru, even Mega has a pre-login which needs email address.
I'm not sure if there is any other way to login to these clouds.

Could be possible to do the login based on webview/default browser and use the user's token to access the account?

 

[HootanParsa]

Could be possible to do the login based on webview/default browser and use the user's token to access the account?

Unfortunately no. Mega API is not using OAuth for authentication and Mail.ru doesn't even have a public API.

 

[Nimueh]

I submitted an appeal and Play answered.
Yes, not only Mail.ru, even Mega has a pre-login which needs email address.
I'm not sure if there is any other way to login to these clouds.

I don't understand Google's issue here.

If a user wants to use MiX to login to Mail.ru or Mega then that user will know that his login credentials HAVE to be sent? And if a user doesn't want that to happen then that user simply can't use MiX to login to those storage sites.

Is Google assuming all of us users don't understand how basic (login) functions work? Or wth am I missing here?

 

[HootanParsa]

I don't understand Google's issue here.

If a user wants to use MiX to login to Mail.ru or Mega then that user will know that his login credentials HAVE to be sent? And if a user doesn't want that to happen then that user simply can't use MiX to login to those storage sites.

Is Google assuming all of us users don't understand how basic (login) functions work? Or wth am I missing here?

Unfortunately there is no way to discuss with Play "support".
They just keep sending many links to read. And I cannot find any option in their form to explain to users why MiXplorer has to send email address to Mail.ru with a plain URL or posting to Mega (and as you said all users already know why). I just have to tell users that this app is collecting and sharing your personal information. And after some hours the nightmare will be started and many users will contact me (nice or offensive) or giving 1 star and saying they're uninstalling the app because MiXplorer is sharing their personal information.
I will think of finding another way for these 2 cloud storages...

 

[IronTechmonkey]

Unfortunately there is no way to discuss with Play "support".
They just keep sending many links to read. And I cannot find any option in their form to explain to users why MiXplorer has to send email address to Mail.ru or Mega with a plain URL (and as you said all users already know why). I just have to tell users that this app is collecting and sharing your personal information. And after some hours the nightmare will be started and many users will contact me (nice to offensive) or giving 1 star and saying they're uninstalling the app because MiXplorer is sharing their personal information.
I will think of finding another way for these 2 cloud storages...

My impression is that Google form is for you to make a declaration to Google about what is "collected" but that is apart from any in-app or Play-store notification to users, and the nature of your answers in the form may oblige you to notify users, but it is not clear if that notification to users should be in the app or at the Play-store page. It's also hard to say what parts of this Google actually verifies and what part they take on trust until some later conflict between the declarations and the app behavior.

In any event, if you do have to add a notice to users I would hope that most people would understand the logic: that "in order to access credentialed cloud sources then credential information must be sent to the cloud" in fact it might be helpful to use that sort of repetition in any notice. For instance:

"Regarding data collection, in order to access credentialed cloud sources then credential information must be sent to the cloud. This is obviously necessary to access some cloud services but MiXplorer does not send that information anywhere else nor does MiXplorer "collect "any other information. "

If Google makes you add more notices then you could do what big companies do and make the initial advisory to users so long that no one reads it anyhow.

 

[HootanParsa]

My impression is that Google form is for you to make a declaration to Google about what is "collected" but that is apart from any in-app or Play-store notification to users, and the nature of your answers in the form may oblige you to notify users, but it is not clear if that notification to users should be in the app or at the Play-store page. It's also hard to say what parts of this Google actually verifies and what part they take on trust until some later conflict between the declarations and the app behavior.

In any event, if you do have to add a notice to users I would hope that most people would understand the logic: that "in order to access credentialed cloud sources then credential information must be sent to the cloud" in fact it might be helpful to use that sort of repetition in any notice. For instance:

"Regarding data collection, in order to access credentialed cloud sources then credential information must be sent to the cloud. This is obviously necessary to access some cloud services but MiXplorer does not send that information anywhere else nor does MiXplorer "collect "any other information. "

If Google makes you add more notices then you could do what big companies do and make the initial advisory to users so long that no one reads it anyhow.

Google will show what I have selected in the app page under Data safety:

MiXplorer Silver File Manager - Apps on Google Play

A full-featured file manager

play.google.com

I will investigate to see if there are other ways to login and if I couldn't find any then I will look at Play options again and if I didn't like it, I will make add-ons for those cloud storages.

 

[IronTechmonkey]

Google will show what I have selected in the app page under Data safety:

That is indeed a challenge in terms of making sure users see an initial reminder that data is not actually "collected" as soon as the users see the Google notice. You would have to put additional descriptions at play store and in the app to mitigate that. Anyhow, enough of that from me, now switching gears to testing "Undo".

 

[IronTechmonkey]

Undo in 6.59.0-BETA-B23012610, anyone? That's not another song reference but rather a real question.

There are still issue with Undo but first, "Very clever, Mr. Bond". With Recycle bin and Undo disabled, now [Select > long press delete] invokes the permanent delete prompt as would be the case if the delete button had been tapped with items selected, without copying the file to .recycle (and without creating .recycle). I hope people who wanted long press to delete for recycle can understand this may be a good compromise that allows people to disable the recycle stuff if they choose to, and in either case long press delete follows the user's choice.

As to Recycle Bin and undo in 6.59.0-BETA-B23012610: After any file operation or deletion then Menu > Undo yields a toast stating "no item". The Undo material seems to exist in .recycle but unless I'm missing some new option there is no way to Undo anything via the UI. Recycled items exist in the the . recycle tree and can be recovered manually but undo material for the file copy and move operations are buried in the data files and there seems to be no way to undo those operations.

With the recycle bin and undo enabled, the attached log spans a file deletion, then an attempt to undo, then a file copy, then an attempt to undo, then a file move, then an attempt to undo. All attempts to undo yield the "no item" toast. In the log each of the 3 groups of repeated log lines "E/RecycleHelper> No item!" is from one of the 3 tested file operations.

For privacy, the following changes were made in the log: External SD label replaced by "LABEL". Renamed 2 folders not involved with the test to "REDACTED1" and "REDACTED2"

 

[J.Michael]

Google will show what I have selected in the app page under Data safety:

MiXplorer Silver File Manager - Apps on Google Play

A full-featured file manager

play.google.com

I will investigate to see if there are other ways to login and if I couldn't find any then I will look at Play options again and if I didn't like it, I will make add-ons for those cloud storages.

I wonder if Google's only clue that you "collect" e-mail addresses is that you labelled a field "Email" (Mail.RU Add Storage). Or is there a special "e-mail address input text box" widget?

Maybe you can make them happy by declaring that you "collect" e-mail addresses, usernames, passwords, all for "App functionality". (I looked at the Data Safety statements of a few e-mail client apps -- MailRU, Gmail, etc.)

And maybe emphasize that you use SSL when the server allows.

(That drivel about end-to-end encryption makes no sense to me: Google seems to imagine the encryption happening outside of the app, so why would the app even know?)

 

[HootanParsa]

I wonder if Google's only clue that you "collect" e-mail addresses is that you labelled a field "Email" (Mail.RU Add Storage). Or is there a special "e-mail address input text box" widget?

Maybe you can make them happy by declaring that you "collect" e-mail addresses, usernames, passwords, all for "App functionality". (I looked at the Data Safety statements of a few e-mail client apps -- MailRU, Gmail, etc.)

And maybe emphasize that you use SSL when the server allows.

(That drivel about end-to-end encryption makes no sense to me: Google seems to imagine the encryption happening outside of the app, so why would the app even know?)

Yeah, I was reading Play resources again and now I think the problems are more than that because of features like Share/SendTo,...

 

[J.Michael]

Yeah, I was reading Play resources again and now I think the problems are more than that because of features like Share/SendTo,...

Share/SendTo should be cases of "action initiated by user".

 

[HootanParsa]

When I disable encryption in samba settings on the server:


And I set Mixplorer to use smb3:


I get the following error message displayed in mixplorer window:

"libs.a66: Message signing is required, but no signing key is negotiated"

Is there any "advanced settings" command to fix it? Or in Mixplorer SMB3's encryption is mandatory?


EDIT:
@HootanParsa I got a small issue using the newest version of samba (4.17.4). No matter if I use SMB2 or SMB3, whenever I delete a file it remains visible in the folder until I use the refresh button (or gesture). Mixplorer shows a pop-up message saying "1 file successfully deleted" (or something like this), but the file remains visible in the folder. It isn't happening with older Samba version (4.13). The samba log is the following:

I couldn't find any option to disable the encryption. I have to work on the SMB library myself.
Please send me an email with a log file from MiXplorer > 3-dots menu > Send log.