Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android account passwords are stored on disk in plain text

code.google.com

Post reply on HN
Print view View original

61–70 of 93 posts

Re: Android account passwords are stored on disk in plain text

#61

Post by inportb »

1880 wrote: post #54
ConstantineXVI wrote: post #42

Earlier quoted context omitted.

1) Official root methods (see `fastboot oem unlock`, as made famous by the Nexus phones) as well as many less official methods require a wipe, thus rendering this attack moot. 2) In the event your phone isn't covered by the situation in #1, having a passcode lock and not enabling ADB (developer mode) should be sufficient to protect from a root attack in most cases. It's worth noting that you're still vulnerable to a…

> if you've rooted your phone yourself, any OS security is null and void Are you sure? If I am not mistaken, even with a rooted phone, a program has to ask the user for root permission via the Superuser.apk app.

Ah, but how does this Superuser.apk achieve root privileges? By calling the setuid root `su` program, you say.

And how does this setuid root program actually gain root privileges? Why, the OS is able to execute arbitrary code with arbitrary privileges, and it makes an exception for `su`.

Wait... so Android could run processes with root privileges without asking you? Whoa!

Now consider that adbd on a rooted device runs with root privileges...

Re: Android account passwords are stored on disk in plain text

#62

Post by lotu »

wheels wrote: post #32
mrb wrote: post #28

Earlier quoted context omitted.

I guess we agree (see my edit). By "hardware ID", you mean a unique salt. Unfortunately even with a unique salt, 7-digit PINs are not strong enough if, from a theoretical viewpoint, we assume they can be bruteforced at a few thousand per second. Does Apple IOS really use PBKDF2? The Fraunhofer paper does not mention it. http://sit.sit.fraunhofer.de/studies/en/sc-iphone-passwords....

Android supports text passwords as well. Also, in a sane security model, it'd be possible to separate having a long password for elevated privileges (i.e. things that could further open the door to compromises like booting and installing apps) from the one simply to unlock the screen. Your average consumer probably wouldn't avail themselves to such measures, but it'd let the paranoid and companies with security polic…

If you are paranoid you don't store the password in the first place.

Re: Android account passwords are stored on disk in plain text

#63

Post by kgermino »

daeken wrote: post #9
wheels wrote: post #3

I recently joined the cult of the smartphone (after my feature phone finally kicked the bucket). Since I, like presumably many folks, set things up so that I could check my email, used the web browser and let it store some passwords, I became curious about how those passwords are being stored. It turns out that it's just an SQLite database where they're stored in plain text. This leaves me somewhat disconcerted since…

Edit: This is COMPLETELY INCORRECT (as pointed out by wallflower) but left for context. I can't test right now, but if your phone has ADB enabled, can't you pull this file over USB? I could be totally, totally off on that, though.

Thank you for leaving the original for context, it's drives me nuts when people delete a message or edit out the content when there's a string of replies.

Re: Android account passwords are stored on disk in plain text

#65

Post by cryos »

jrockway wrote: post #43
cryos wrote: post #24

Earlier quoted context omitted.

No doubt you'll get the standard reply "Its open source the community should fix this".

The person who wants the software fixed should fix it. This isn't a cop-out, it's simple economics. If you want a pony, go buy a pony. Otherwise, STFU.

If I buy a pony I expect to be a pony, not to be a donkey.

Its definitely a total cop out because no one is taking responsibility on the matter, bugs are being ignored, and Google has made a history so far of passing blame and not addressing issues with Android.

Lastly thats a moronic statement "The person who wants the software fixed should fix it". Android tends to attract lower income people who tend not to be IT orientated. If you told any of these peoples the dangers of identity theft they would want this changed, but its out of there capability to address. TBH I don't know how you can even have such a stupid stance.

Re: Android account passwords are stored on disk in plain text

#66

Post by lotu »

st3fan wrote: post #46
mrb wrote: post #2

Cleartext passwords are perfectly fine in this case. I speak as a software engineer specialized in security. This bug report was filed by someone who doesn't understand that obfuscating a password is different from encrypting it. No matter how you store it, the application must be able to extract a cleartext password from whatever storage options are available on the Android device. For a longer explanation: http://d…

Cleartext passwords are perfectly fine in this case. I speak as a software engineer specialized in security. These passwords should of course be stored in a Keychain-like component that the OS provides. Are you sure you are specialized in security?

The OS can't provide a key ring because the user dosen't use a password to login. Or if they do have an unlock code they are short and numeric, making brute forcing them trivial. So yes, in this case plain text is acceptable because there is no truly better alternative.

Re: Android account passwords are stored on disk in plain text

#67

Post by Hisoka »

A general question about Sqlite databases in Android and iPhones... since an application can read and write to it.. can't they read records written by other applications as well? Isn't this a security risk if you install an app that tries to look for passwords in your Sqlite DB?

Re: Android account passwords are stored on disk in plain text

#69

Post by drivebyacct2 »

daeken wrote: post #37
drivebyacct2 wrote: post #26

Earlier quoted context omitted.

No. No it's not. please tell me how someone is going to get those passwords without root. (hint, they're not) additionally, how is this different than NY laptop with Pidgin accounts, my IMAP client, Firefox's stored passwords, etc.

> No. No it's not. please tell me how someone is going to get those passwords without root. (hint, they're not) By running an exploit to get up to root, or by attacking it physically. Neither of these are particularly difficult or unlikely. > additionally, how is this different than NY laptop with Pidgin accounts, my IMAP client, Firefox's stored passwords, etc. It's not, if you're saving passwords without a master k…

>By running an exploit to get up to root, or by attacking it physically. Neither of these are particularly difficult or unlikely.

Keeping in mind that root-escalation bugs are back ported and shipped to consumers quickly and often silently, I find that claim to be a bit bold. In fact, the popular root escalation of choice these days is very specific and must be used in conjuncture with ADB. Rogue software is going to have a hellofa time just accessing this file.

>If you're using, say, 1Password, then your master key has to be compromised to get the passwords.

I'm not sure we're talking about the same thing, or you missed my point: if I teach Pidgin how to login to my IM accounts (or Thunderbird, IMAP; Email.apk, my POP server; my Facebook notifier, my FB account credentials)... then those applications HAVE to cache those passwords in plaintext. Unless you're so security conscious that you type them in every time you launch your IM client. (Props if you do, but that's the scenario I'm discussing. I'm just taken aback by the pure ignorance exuded in the linked bug report)

Basically, even with this "vulnerability" that absolutely can't be avoided in many cases... Android is still better off than your laptop, barring an unlikely root escalation bug (remembering of course Google's stewardship of the Market and them taking down applications using such exploits)

edit: I have no problem with the notion of using oAuth to mitigate or eliminate this problem. Unfortunately, as a user or even a third party developer, that's not really a decision I get to make.

Re: Android account passwords are stored on disk in plain text

#70

Post by drivebyacct2 »

chopsueyar wrote: post #34
drivebyacct2 wrote: post #26

Earlier quoted context omitted.

No. No it's not. please tell me how someone is going to get those passwords without root. (hint, they're not) additionally, how is this different than NY laptop with Pidgin accounts, my IMAP client, Firefox's stored passwords, etc.

Couldn't someone take the hard drive out of your laptop and mount it in on another system and peruse through the necessary files?

Well that's just it isn't it. If you took (not mine, but most people's laptop), you'd be able to read out all of their cookies (fun, in and of itself), read the contents of their saved Firefox passwords, read the cached/stored passwords for Pidgin, etc, etc.

You can't really remove the flash memory from an Android phone. I mean, you could, but if someone's that interested in you, they're going to get the information through easier or nastier means. Meanwhile, that file is protected by Android, and lacking a root exploit, not much is going to happen.

Google's stewardship of the Market combined with their backporting of root escalation bug fixes makes it very hard for me to get as scared or ironically angry as those in the linked bug report.

Post reply on HN