Samsung Galaxy S3 stores passwords in plain text
1–10 of 38 posts
Re: Samsung Galaxy S3 stores passwords in plain text
#2This thread has more details:
Re: Samsung Galaxy S3 stores passwords in plain text
#3There is no excuse for openly storing passwords like this. Why does Samsung think this is acceptable?
Re: Samsung Galaxy S3 stores passwords in plain text
#4There is no excuse for openly storing passwords like this. Why does Samsung think this is acceptable?
Why is storing them encrypted locally any better? Someone with root has access to the decryption keys anyway.
Re: Samsung Galaxy S3 stores passwords in plain text
#5There is no excuse for openly storing passwords like this. Why does Samsung think this is acceptable?
Why is storing them encrypted locally any better? Someone with root has access to the decryption keys anyway.
Really? So device encryption is pointless then? Same for a jailbroken iPhone? That seems hard to believe.
Re: Samsung Galaxy S3 stores passwords in plain text
#6This is a really bad article. I would call it nothing less than fear-mongering. Let's say they decided to encrypt the file. They would have to store that key in plain-text somewhere. Of course, they could encrypt that, but then that key would have to be stored somewhere.
No matter how they decided to store the password, if somebody has root access to the device, they can find a way to read it. If they can't find a way, the phone won't either, so it won't be able to log you in.
The only answer is to not let your device store your password. Choose security or convenience, but don't expect both.
(This is no different than Pidgin storing your passwords in plaintext[1] with the exact same reasons and consequences.)
Re: Samsung Galaxy S3 stores passwords in plain text
#7Earlier quoted context omitted.
Why is storing them encrypted locally any better? Someone with root has access to the decryption keys anyway.
Really? So device encryption is pointless then? Same for a jailbroken iPhone? That seems hard to believe.
If you don't have something like a lock code it is pointless because then you have nothing to lock the encryption with.
The iphone works with its lock code.
Re: Samsung Galaxy S3 stores passwords in plain text
#8Earlier quoted context omitted.
Why is storing them encrypted locally any better? Someone with root has access to the decryption keys anyway.
Really? So device encryption is pointless then? Same for a jailbroken iPhone? That seems hard to believe.
This is not what's under debate here.
Without device encryption, encryption of the passwords is useless, given root access, since the key is somewhere on the device as well. If anything, the only crime here is not using access tokens but storing the whole password.
With device encryption, the situation changes slightly. Unlike iDevices, most (all?) Android phones don't come with a hardware encryption chip, so, given a vulnerable bootloader, full-device encryption doesn't do much in the way of security. Under a secure bootloader, device encryption should be secure as well.
Re: Samsung Galaxy S3 stores passwords in plain text
#9This is developer sloppiness. Google provides plenty of methods to authenticate users without persisting user credentials to disk. There's no reason an application would need to store your Google login to disk, unencrypted or otherwise.
Re: Samsung Galaxy S3 stores passwords in plain text
#10This is a really bad article. I would call it nothing less than fear-mongering. Let's say they decided to encrypt the file. They would have to store that key in plain-text somewhere. Of course, they could encrypt that, but then that key would have to be stored somewhere. No matter how they decided to store the password, if somebody has root access to the device, they can find a way to read it. If they can't find a wa…
Yes but there are other ways to mitigate the risks somewhat. Temporary revokable tokens would at least mean an attacker doesn't gain a permanent foothold, and never discovers the password.