Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android account passwords are stored on disk in plain text

code.google.com

Post reply on HN
Print view View original

71–80 of 93 posts

Re: Android account passwords are stored on disk in plain text

#71

Post by jrockway »

cryos wrote: post #65
jrockway wrote: post #43

Earlier quoted context omitted.

The person who wants the software fixed should fix it. This isn't a cop-out, it's simple economics. If you want a pony, go buy a pony. Otherwise, STFU.

If I buy a pony I expect to be a pony, not to be a donkey. Its definitely a total cop out because no one is taking responsibility on the matter, bugs are being ignored, and Google has made a history so far of passing blame and not addressing issues with Android. Lastly thats a moronic statement "The person who wants the software fixed should fix it". Android tends to attract lower income people who tend not to be IT…

Sure, Google should fix it. But they're not. So now what?

One of my main problems with people in general is that they want to assign blame, not solve problems. So, okay, blame Google. But that's not getting you closer to a solution. Typing in code to fix the problem is the solution.

Finally, to address one point:

If I buy a pony I expect to be a pony, not to be a donkey.

That's reasonable, but this is software. You know all those CAPITAL LETTERS rambling on about NO WARRANTY. That's what this is. There's a defect and they don't have to fix it because you signed away all your rights to get the software. Vote with your wallet: only buy software that's proved correct.

Re: Android account passwords are stored on disk in plain text

#72

Post by barista »

lotu wrote: post #62
wheels wrote: post #32

Earlier quoted context omitted.

Android supports text passwords as well. Also, in a sane security model, it'd be possible to separate having a long password for elevated privileges (i.e. things that could further open the door to compromises like booting and installing apps) from the one simply to unlock the screen. Your average consumer probably wouldn't avail themselves to such measures, but it'd let the paranoid and companies with security polic…

If you are paranoid you don't store the password in the first place.

Or use android for that matter

Re: Android account passwords are stored on disk in plain text

#73

Post by gst »

mrb wrote: post #2

Cleartext passwords are perfectly fine in this case. I speak as a software engineer specialized in security. This bug report was filed by someone who doesn't understand that obfuscating a password is different from encrypting it. No matter how you store it, the application must be able to extract a cleartext password from whatever storage options are available on the Android device. For a longer explanation: http://d…

A passphrase won't really help, because passphrases user's typically use on a secure device will be too simple.

Re: Android account passwords are stored on disk in plain text

#74

Post by rcxdude »

1880 wrote: post #54
ConstantineXVI wrote: post #42

Earlier quoted context omitted.

1) Official root methods (see `fastboot oem unlock`, as made famous by the Nexus phones) as well as many less official methods require a wipe, thus rendering this attack moot. 2) In the event your phone isn't covered by the situation in #1, having a passcode lock and not enabling ADB (developer mode) should be sufficient to protect from a root attack in most cases. It's worth noting that you're still vulnerable to a…

> if you've rooted your phone yourself, any OS security is null and void Are you sure? If I am not mistaken, even with a rooted phone, a program has to ask the user for root permission via the Superuser.apk app.

But, if you're rooted, you likely have a custom recovery and bootloader which will accept commends freely, so it is pretty trivial to pull arbitrary stuff from the phone. You should, however, be safe from other routes, so long as you disable adb (which also freely accepts commands as root in most ROMS), Filesytem encryption would close all these attacks, but I'm not aware of any particular implementations (I'm pretty sure there aren't any popular ones)

Re: Android account passwords are stored on disk in plain text

#75

Post by vetinari »

inportb wrote: post #61
1880 wrote: post #54

Earlier quoted context omitted.

> if you've rooted your phone yourself, any OS security is null and void Are you sure? If I am not mistaken, even with a rooted phone, a program has to ask the user for root permission via the Superuser.apk app.

Ah, but how does this Superuser.apk achieve root privileges? By calling the setuid root `su` program, you say. And how does this setuid root program actually gain root privileges? Why, the OS is able to execute arbitrary code with arbitrary privileges, and it makes an exception for `su`. Wait... so Android could run processes with root privileges without asking you? Whoa! Now consider that adbd on a rooted device run…

Jumping to conclusions, are we?

Superuser.apk does not achieve root privileges and su does not blindly run your program with root privileges. su asks superuser.apk, if your program is allowed to run as root and only when superuser.apk agrees (and displays toast), then your program is run.

Also, the arbitrary privileges are reserved for setuid programs, which is not easy to achieve. Basically, su and Superuser.apk are gatekeepers to uid 0, which short of bugs, you can't get around.

Also, did you know, that you can disable adbd? Or remove root privileges from it?

Re: Android account passwords are stored on disk in plain text

#76

Post by vetinari »

jrockway wrote: post #71
cryos wrote: post #65

Earlier quoted context omitted.

If I buy a pony I expect to be a pony, not to be a donkey. Its definitely a total cop out because no one is taking responsibility on the matter, bugs are being ignored, and Google has made a history so far of passing blame and not addressing issues with Android. Lastly thats a moronic statement "The person who wants the software fixed should fix it". Android tends to attract lower income people who tend not to be IT…

Sure, Google should fix it. But they're not. So now what? One of my main problems with people in general is that they want to assign blame, not solve problems. So, okay, blame Google. But that's not getting you closer to a solution. Typing in code to fix the problem is the solution. Finally, to address one point: If I buy a pony I expect to be a pony, not to be a donkey. That's reasonable, but this is software. You k…

> Vote with your wallet: only buy software that's proved correct.

For all intents and purposes, people in last 50 years proved, that they do not want correct software. In many cases, they can't even describe what correct software should do. They want cheap (= keyword!) software, that kinda-sorta is fit for intended purpose.

Re: Android account passwords are stored on disk in plain text

#77

Post by m3koval »

drivebyacct2 wrote: post #26
wheels wrote: post #3

I recently joined the cult of the smartphone (after my feature phone finally kicked the bucket). Since I, like presumably many folks, set things up so that I could check my email, used the web browser and let it store some passwords, I became curious about how those passwords are being stored. It turns out that it's just an SQLite database where they're stored in plain text. This leaves me somewhat disconcerted since…

No. No it's not. please tell me how someone is going to get those passwords without root. (hint, they're not) additionally, how is this different than NY laptop with Pidgin accounts, my IMAP client, Firefox's stored passwords, etc.

If you're using a password management utility, root access to the filesystem isn't enough because all stored passwords are encrypted a password that is never stored on disk. One example of this, I believe, is Keychain using your login password for encryption in OS X.

Unfortunately, this doesn't work as well on a phone. Because of the awkward entry mechanism, passwords are likely to be shorter and to contain much less variation.

Re: Android account passwords are stored on disk in plain text

#78

Post by crocowhile »

drivebyacct2 wrote: post #26
wheels wrote: post #3

I recently joined the cult of the smartphone (after my feature phone finally kicked the bucket). Since I, like presumably many folks, set things up so that I could check my email, used the web browser and let it store some passwords, I became curious about how those passwords are being stored. It turns out that it's just an SQLite database where they're stored in plain text. This leaves me somewhat disconcerted since…

No. No it's not. please tell me how someone is going to get those passwords without root. (hint, they're not) additionally, how is this different than NY laptop with Pidgin accounts, my IMAP client, Firefox's stored passwords, etc.

Actually Android phones cannot use two way authentication so after you enable it in google account you will have to create an application specific password: that means that your android phone will login to google account using your usual username and a "per application" password randomly generated by google. That is the one that is stored in the sql db.

All google has to do is to make sure that you cannot login using that same password from two concurrent sessions. So if your phone is stolen: you revoke the android-specific password; if your db is phished or acquired, google will revoke the android-specific password once the attackers tries to use it.

Re: Android account passwords are stored on disk in plain text

#79

Post by Tichy »

daeken wrote: post #7
mrb wrote: post #2

Cleartext passwords are perfectly fine in this case. I speak as a software engineer specialized in security. This bug report was filed by someone who doesn't understand that obfuscating a password is different from encrypting it. No matter how you store it, the application must be able to extract a cleartext password from whatever storage options are available on the Android device. For a longer explanation: http://d…

Actually, they are not perfectly fine in this case. They should take the Apple approach and use PBKDF2 to derive a key from the PIN/passphrase, if one is set, then use that to encrypt the database. Anything less is simply not OK. Edit: You should also use some sort of hardware ID in addition to the PIN/passphrase, otherwise it's trivial to distribute a database of, say, all the <=7-digit PINs.

The email client checks for new mail in the background, though. How is it supposed to do that if the user is currently "logged out" (assuming you mean the pin for unlocking the screen)?

Re: Android account passwords are stored on disk in plain text

#80

Post by darklajid »

chopsueyar wrote: post #36
num1 wrote: post #10

Earlier quoted context omitted.

In the mean time, be sure to enable two-factor authentication on your account. I'll admit it's not much solace as usually the second factor uses your phone...

Is that a Catch-22?

No, because

- the password you store on the phone (in cleartext) is not the real account password, it's a string for this device only and you can revoke access at any time

- Someone should not be able to use your phone (via call/text message) as unlock device, unless you lost it

- In that case you should lock the SIM for for a multitude of reasons anyway - and you'll get a new SIM that you can use to recover your account

I think the first one is the most important though: You just don't have to store your real password.

Post reply on HN