android - Android 中的 Firebase 本地数据库有多安全？

Question

我打算切换到 Firebase 作为我的 Android 应用程序的本地和在线数据库。根据文档，Firebase 首先将更改存储到本地数据库，然后在网络可用时将其推送到在线数据库。

在我的应用程序中，我会将一些关于用户的非常敏感的数据放入数据库中。所以这是我的问题，

1. 本地 Firebase 数据库的安全性如何？

2. 使用正确工具的好心黑客破解它有多难？

3. 它只是一个简单的 JSON 文件，就像在线数据库一样，任何拥有 root 访问权限的人都可以打开它吗？

谢谢。

Answer 1

In a general sense, Firebase Realtime Database can be used while offline. However, the expectation is that the app is supposed to be connected most of the time, and changes to the database that happen while offline will be synchronized when it has connectivity. 100% offline use is not really a supported use case, because the canonical data store is on the server.

The local copy of the database is limited to (10MB, at least on Android this is the case). If you intend to write to the database beyond this limit while offline, it will evict part of your cached data to make room for whatever you’re adding. Then, you will no longer be able to read those evicted values until the app goes back online. Worse, managing a growing list of writes to apply when back online is taxing on the app, so you don’t want to plan a lot of writes while offline.

Also, if you have permissions or validations defined for your database, these can only be checked on the server. So, if you’re doing offline writing to your local cache and you no longer have an active listener, you may never know if those writes fail.

Because of these caveats, it’s better not to think of Firebase Realtime Database as an “offline” database. It’s better to think of it as a “synchronized” database that actively syncs to the server while connectivity is present.