Android account passwords are stored on disk in plain text • Hacker News Board

Re: Android account passwords are stored on disk in plain text

#31

Post by marshray » Sat, Jul 23, 2011, 12:46 AM UTC

daeken wrote: post #21

cHalgan wrote: post #18

I'm not security expert at all, so I have a question. If I lock my phone using pin does it mean that my passwords and keys (mentioned in comment #48) are not encrypted using pin+some phone HW ID? Also does encrypting my passwords and keys using pin+some phone HW ID really solves the problem?

> If I lock my phone using pin does it mean that my passwords and keys (mentioned in comment #48) are not encrypted using pin+some phone HW ID? Yes. > Also does encrypting my passwords and keys using pin+some phone HW ID really solves the problem? Yes. No. Sort of. It really depends on what you're trying to protect against. It's absolutely not a panacea, but it will certainly make most attacks against it, where you s…

A PIN short enough for almost any user to be bothered entering it to unlock the phone is not going to be long enough to resist brute force attacks, even with a 10,000x PBKDF2 work factor.

Re: Android account passwords are stored on disk in plain text

#32

Post by wheels » Sat, Jul 23, 2011, 12:46 AM UTC

mrb wrote: post #28

daeken wrote: post #7

Earlier quoted context omitted.

Actually, they are not perfectly fine in this case. They should take the Apple approach and use PBKDF2 to derive a key from the PIN/passphrase, if one is set, then use that to encrypt the database. Anything less is simply not OK. Edit: You should also use some sort of hardware ID in addition to the PIN/passphrase, otherwise it's trivial to distribute a database of, say, all the <=7-digit PINs.

I guess we agree (see my edit). By "hardware ID", you mean a unique salt. Unfortunately even with a unique salt, 7-digit PINs are not strong enough if, from a theoretical viewpoint, we assume they can be bruteforced at a few thousand per second. Does Apple IOS really use PBKDF2? The Fraunhofer paper does not mention it. http://sit.sit.fraunhofer.de/studies/en/sc-iphone-passwords....

Android supports text passwords as well. Also, in a sane security model, it'd be possible to separate having a long password for elevated privileges (i.e. things that could further open the door to compromises like booting and installing apps) from the one simply to unlock the screen.

Your average consumer probably wouldn't avail themselves to such measures, but it'd let the paranoid and companies with security policies at least have semi-reasonable security as an option.

Re: Android account passwords are stored on disk in plain text

#33

Post by chopsueyar » Sat, Jul 23, 2011, 12:48 AM UTC

wallflower wrote: post #22

daeken wrote: post #9

Earlier quoted context omitted.

Edit: This is COMPLETELY INCORRECT (as pointed out by wallflower) but left for context. I can't test right now, but if your phone has ADB enabled, can't you pull this file over USB? I could be totally, totally off on that, though.

No, /data/data/* is protected (as it should be) on non-rooted phones. mediapc:platform-tools media$ ./adb shell $ ls /data/data opendir failed, Permission denied $

But if you have physical access to the phone, why couldn't you root it?

Re: Android account passwords are stored on disk in plain text

#34

Post by chopsueyar » Sat, Jul 23, 2011, 12:50 AM UTC

drivebyacct2 wrote: post #26

wheels wrote: post #3

I recently joined the cult of the smartphone (after my feature phone finally kicked the bucket). Since I, like presumably many folks, set things up so that I could check my email, used the web browser and let it store some passwords, I became curious about how those passwords are being stored. It turns out that it's just an SQLite database where they're stored in plain text. This leaves me somewhat disconcerted since…

No. No it's not. please tell me how someone is going to get those passwords without root. (hint, they're not) additionally, how is this different than NY laptop with Pidgin accounts, my IMAP client, Firefox's stored passwords, etc.

Couldn't someone take the hard drive out of your laptop and mount it in on another system and peruse through the necessary files?

Re: Android account passwords are stored on disk in plain text

#35

Post by supersillyus » Sat, Jul 23, 2011, 12:51 AM UTC

It's nice to bring interesting bugs to light, but I hate how posting links to bugs always results in a pile on of useless comments. It evens says "Each comment triggers notification emails. So, please do not post "+1 Me too!". Instead, click the star icon." next to the comment box, but people apparently think things like "please try to fix it , security on mobile devices need to be more powerful" are worth emailing 500+ people about.

In a sense, it may be Google Code's fault; they shouldn't call them "comments". It's the same terminology that is used on YouTube, HN, and other such sites where people who aren't involved are free to weigh in with whatever they say (albeit with moderation and voting). It should probably be called a "Status update" or some such, as that would give a more accurate impression of what that box is for.

Re: Android account passwords are stored on disk in plain text

#36

Post by chopsueyar » Sat, Jul 23, 2011, 12:51 AM UTC

num1 wrote: post #10

wheels wrote: post #3

I recently joined the cult of the smartphone (after my feature phone finally kicked the bucket). Since I, like presumably many folks, set things up so that I could check my email, used the web browser and let it store some passwords, I became curious about how those passwords are being stored. It turns out that it's just an SQLite database where they're stored in plain text. This leaves me somewhat disconcerted since…

In the mean time, be sure to enable two-factor authentication on your account. I'll admit it's not much solace as usually the second factor uses your phone...

Is that a Catch-22?

Re: Android account passwords are stored on disk in plain text

#37

Post by daeken » Sat, Jul 23, 2011, 1:02 AM UTC

drivebyacct2 wrote: post #26

wheels wrote: post #3

I recently joined the cult of the smartphone (after my feature phone finally kicked the bucket). Since I, like presumably many folks, set things up so that I could check my email, used the web browser and let it store some passwords, I became curious about how those passwords are being stored. It turns out that it's just an SQLite database where they're stored in plain text. This leaves me somewhat disconcerted since…

No. No it's not. please tell me how someone is going to get those passwords without root. (hint, they're not) additionally, how is this different than NY laptop with Pidgin accounts, my IMAP client, Firefox's stored passwords, etc.

> No. No it's not. please tell me how someone is going to get those passwords without root. (hint, they're not)

By running an exploit to get up to root, or by attacking it physically. Neither of these are particularly difficult or unlikely.

> additionally, how is this different than NY laptop with Pidgin accounts, my IMAP client, Firefox's stored passwords, etc.

It's not, if you're saving passwords without a master key. If you're using, say, 1Password, then your master key has to be compromised to get the passwords.

Re: Android account passwords are stored on disk in plain text

#38

Post by daeken » Sat, Jul 23, 2011, 1:09 AM UTC

walexander wrote: post #29

mrb wrote: post #28

Earlier quoted context omitted.

I guess we agree (see my edit). By "hardware ID", you mean a unique salt. Unfortunately even with a unique salt, 7-digit PINs are not strong enough if, from a theoretical viewpoint, we assume they can be bruteforced at a few thousand per second. Does Apple IOS really use PBKDF2? The Fraunhofer paper does not mention it. http://sit.sit.fraunhofer.de/studies/en/sc-iphone-passwords....

If you use a TPM to store your device encryption key, a PIN combination should be fine. Of course, by definition that requires hardware support. I work in Android security in particular for a manufacturer. We came across the unencrypted email pass ourselves, but decided it was fine for two reasons: 1) If you don't get rooted, there should be no way to pull from /data/data/* in the first place. 2) With filesystem encr…

A TPM is obviously the best solution here, on all counts, but it's not possible to put one into every phone that's already been sold, so clearly we need a software mechanism that at least helps.

As it stands, if an attacker gains root on your device (which could be locally, via a malicious app running a local root, or via a malicious page exploiting a browser bug and then escalating with a local root), they have the keys to the castle. This is true whether you have filesystem encryption on or not.

Leaving these in plaintext is equivalent to storing plaintext passwords in /etc/shadow; yes, only root can access it, but getting root is by no means impossible. If an attacker does get access to it, it shouldn't be an immediate game-over for your passwords.

Re: Android account passwords are stored on disk in plain text

#39

Post by xiaoqmaxee » Sat, Jul 23, 2011, 1:10 AM UTC

mrb wrote: post #2

Cleartext passwords are perfectly fine in this case. I speak as a software engineer specialized in security. This bug report was filed by someone who doesn't understand that obfuscating a password is different from encrypting it. No matter how you store it, the application must be able to extract a cleartext password from whatever storage options are available on the Android device. For a longer explanation: http://d…

welcometo: http://www.fullmalls.com The website wholesale for many kinds of fashion shoes, like the nike,jordan,prada,, also including the jeans,shirts,bags,hat and the decorations. All the products are free shipping, and the the price is competitive, and also can accept the paypal payment.,after the payment, can ship within short time. free shippingcompetitive priceany size availableaccept the paypal ===== http://www.fullmalls.com =====

jordan shoes $32nike shox $32Christan Audigier bikini $23 Ed Hardy Bikini $23Smful short_t-shirt_woman $15ed hardy short_tank_woman $16Sandal $32christian loubo utin $80 Sunglass $15 COACH_Necklace $27handbag $33AF tank woman $17puma slipper woman $30

===== http://www.fullmalls.com =====

Re: Android account passwords are stored on disk in plain text

#40

Post by daeken » Sat, Jul 23, 2011, 1:10 AM UTC

sdizdar wrote: post #27

walexander wrote: post #20

Earlier quoted context omitted.

The correct answer is to use a TPM - Trusted Platform Module - for that key. Accessing the TPM itself requires a password, but the hardware prevents against bruteforce/dictionary attacks.

Does Apple iPhone uses mobile TPM? Any known mobile phone?

The iPhone does not, and I'm not aware of any that do. Even the Blackberry, which is intended for high security of such things, simply uses PBKDF2. However, a TPM is the best solution here.