Flutter - Why/How is flutter_secure_storage secure?

Question

I think I don`t understand this mechanism at all.

You are supposed to create it by setting a key value, but if someone decompiles the flutter code and reads it again with flutter_secure_storage, doesn't it all show up?

https://pub.dev/packages/flutter_secure_storage

The documentation explanation is too short. I want to keep my private key safe. Anyone could tell me more about this issue & mechanism??

---

PLUS

I just set the key value, but realized that the key value is not visible on other phones. If this happens, the cell phone has to expose the private key every time the app is opened for the first time... I don't know why this is secure.

Answer 1

Note the difference between a cryptographic key and a map key. The key you provide to the flutter_secure_storage api is more akin to a label, one you use to find the correct value to retrieve. The cryptographic key is provided/handled by the library together with the device KeyStore, and as such is typically only available after the user unlocks with a biometric prompt (fingerprint etc.).