Android account passwords are stored on disk in plain text
code.google.com
Android account passwords are stored on disk in plain text
1–10 of 93 posts
Re: Android account passwords are stored on disk in plain text
#2Cleartext passwords are perfectly fine in this case. I speak as a software engineer specialized in security.
This bug report was filed by someone who doesn't understand that obfuscating a password is different from encrypting it. No matter how you store it, the application must be able to extract a cleartext password from whatever storage options are available on the Android device.
For a longer explanation: http://developer.pidgin.im/wiki/PlainTextPasswords
That said, one defense-in-depth mechanism that I would like to see on portable devices like phones would be to have an encrypted storage area that is only accessible after typing a passphrase at boot time (the key derived from this passphrase should be stored in volatile memory only). That way if the device is shut down, this secure area would not be decryptable.
Edit: I am defending the mail application because from its viewpoint it is fine to use cleartext passwords. On the other hand the OS should provide a secure storage area as described in my previous paragraph.
Re: Android account passwords are stored on disk in plain text
#3I recently joined the cult of the smartphone (after my feature phone finally kicked the bucket). Since I, like presumably many folks, set things up so that I could check my email, used the web browser and let it store some passwords, I became curious about how those passwords are being stored.
It turns out that it's just an SQLite database where they're stored in plain text. This leaves me somewhat disconcerted since I carry my phone around everywhere (and have a bad habit of losing them – hence waiting for ages to get a smart phone until they dropped below the price of "this won't hurt too much if I lose it"). My assumption had been that since I set a password to unlock the screen (and have a SIM card password) that it'd be tied into a keychain mechanism that unlocked access to an encrypted password store.
While normal apps can't read said file (unless the phone is rooted), it's still a pretty huge vector for identity theft making it rather trivial to extract passwords from a lost / stolen phone.
Re: Android account passwords are stored on disk in plain text
#4please fix!
Re: Android account passwords are stored on disk in plain text
#5The title should probably mention that it only effects email. Comment #48 explains the reasoning behind it, and frankly seems perfectly reasonable.
Re: Android account passwords are stored on disk in plain text
#6Well, what's the right way to encrypt this kind of stuff?
Even if you're doing some kind of public-key cryptography, you're still going to have to store the private key at some location on the device, to decrypt the password for IMAP/SMTP/whatever authentication.
Is there some foolproof way to do this that I'm not aware of? How are you supposed to store a password for future retrieval, not in plain text or basically plain text (encrypted but with the key on the device)?
Re: Android account passwords are stored on disk in plain text
#7Cleartext passwords are perfectly fine in this case. I speak as a software engineer specialized in security. This bug report was filed by someone who doesn't understand that obfuscating a password is different from encrypting it. No matter how you store it, the application must be able to extract a cleartext password from whatever storage options are available on the Android device. For a longer explanation: http://d…
Actually, they are not perfectly fine in this case. They should take the Apple approach and use PBKDF2 to derive a key from the PIN/passphrase, if one is set, then use that to encrypt the database. Anything less is simply not OK.
Edit: You should also use some sort of hardware ID in addition to the PIN/passphrase, otherwise it's trivial to distribute a database of, say, all the <=7-digit PINs.
Re: Android account passwords are stored on disk in plain text
#8Well, what's the right way to encrypt this kind of stuff? Even if you're doing some kind of public-key cryptography, you're still going to have to store the private key at some location on the device, to decrypt the password for IMAP/SMTP/whatever authentication. Is there some foolproof way to do this that I'm not aware of? How are you supposed to store a password for future retrieval, not in plain text or basically…
You derive a key from some piece of user input and use that to encrypt it. If you also mix in, say, a hardware ID, then you also make it impossible to distribute a set of common keys.
Re: Android account passwords are stored on disk in plain text
#9I recently joined the cult of the smartphone (after my feature phone finally kicked the bucket). Since I, like presumably many folks, set things up so that I could check my email, used the web browser and let it store some passwords, I became curious about how those passwords are being stored. It turns out that it's just an SQLite database where they're stored in plain text. This leaves me somewhat disconcerted since…
Edit: This is COMPLETELY INCORRECT (as pointed out by wallflower) but left for context.
I can't test right now, but if your phone has ADB enabled, can't you pull this file over USB? I could be totally, totally off on that, though.
Re: Android account passwords are stored on disk in plain text
#10I recently joined the cult of the smartphone (after my feature phone finally kicked the bucket). Since I, like presumably many folks, set things up so that I could check my email, used the web browser and let it store some passwords, I became curious about how those passwords are being stored. It turns out that it's just an SQLite database where they're stored in plain text. This leaves me somewhat disconcerted since…
In the mean time, be sure to enable two-factor authentication on your account. I'll admit it's not much solace as usually the second factor uses your phone...