Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Samsung Galaxy S3 stores passwords in plain text

geek.com

Post reply on HN
Print view View original

21–30 of 38 posts

Re: Samsung Galaxy S3 stores passwords in plain text

#21

Post by bigiain »

ricardobeat wrote: post #17
SoftwareMaven wrote: post #6

This is a really bad article. I would call it nothing less than fear-mongering. Let's say they decided to encrypt the file. They would have to store that key in plain-text somewhere. Of course, they could encrypt that, but then that key would have to be stored somewhere. No matter how they decided to store the password, if somebody has root access to the device, they can find a way to read it. If they can't find a wa…

It is bad either way. The phone should keep an access token (which can be revoked), not store the user's password.

That's a great plan - we now just need to convince every website and web service (and whatever else your phone authenticates with) to update their authentication method to use these access tokens.

So are you going to phone Apple and ask them to change their website/ITMS/iCloud/DeveloperCenter password/authentication system? No? Neither am I.

Samsung storing the passwords in cleartext is lazy, but if the assumption is "you can only read that cleartext file if you've got root", since a consequence of having root means you can intercept anything the user does anyway, it's _maybe_ an excusable decision. I'm quite surprised they didn't choose to use a passwordsafe/keypass/lastpass/1Password style encrypted storage format though. It's not exactly rocket surgery…

(I wonder how that file appears on backups though? Does Android by-default encrypt backups? I know iPhone _can_ encrypt them, but doesn't by default. This file could be quite dangerous if it's sitting on a lot of people's laptops/desktops unencrypted...)

Re: Samsung Galaxy S3 stores passwords in plain text

#22

Post by bigiain »

aristidb wrote: post #14
yuliyp wrote: post #4

Earlier quoted context omitted.

Why is storing them encrypted locally any better? Someone with root has access to the decryption keys anyway.

It isn't. Storing passwords on a mobile device, unencrypted or encrypted, is just wrong. Fortunately authenticating with Google services requires neither.

The problem is, I want my phone to be able to authenticate with way more than just Google services.

And I want it to be able to do that in a way which doesn't require me to remember several dozen secure-against-2012-vintage-password-cracking-techniques.

I _know_ that sometime in the next year or two we'll see another password leak like, say, LinkedIn's recent one - so I know I need to use 12+ "upper, lower, number, and 'special'" character non-dictionary passwords to ensure I'm not trivially exposed by rainbow tables or gpu crackers.

A quick count on my phone just now, there's at least 33 different services my phone "remembers" it's login for. Some of them use OAuth-style authentication (Twitter and Flickr, for example), and some (Google, Facebook, and Amazon) are 3 factor auth protected (but, against a rooted phone that wouldn't help much, since I'm using the Google Authenticator app to generate the auth tokens, if my phone were under someone elses control they could watch me using and unlocking the authenticator app...)

But there are still dozens of services - email accounts, websites, web service backed apps - that require the phone to have access to the cleartext password, either from me remembering it and typing it in, or from it's own storage mechanisms - secure or not.

My phone would be _remarkably_ less useful to me if it didn't store passwords, or only worked with services that didn't require password storage.

Re: Samsung Galaxy S3 stores passwords in plain text

#23

Post by jayfuerstenberg »

yuliyp wrote: post #4
jayfuerstenberg wrote: post #3

There is no excuse for openly storing passwords like this. Why does Samsung think this is acceptable?

Why is storing them encrypted locally any better? Someone with root has access to the decryption keys anyway.

The decryption keys aren't just sitting out in the open so any amount of encryption is better than none.

This is like asking why would we encrypt data on a server since the decryption keys are accessible.

Of course they are, they're needed to decrypt the data. But at least it takes more time to find the keys and that "can" be a deterrent much the way "The Club" is a visual deterrent that can still keep a car from being stolen by demanding too much time to break it.

Re: Samsung Galaxy S3 stores passwords in plain text

#24

Post by charlesju »

jayfuerstenberg wrote: post #23
yuliyp wrote: post #4

Earlier quoted context omitted.

Why is storing them encrypted locally any better? Someone with root has access to the decryption keys anyway.

The decryption keys aren't just sitting out in the open so any amount of encryption is better than none. This is like asking why would we encrypt data on a server since the decryption keys are accessible. Of course they are, they're needed to decrypt the data. But at least it takes more time to find the keys and that "can" be a deterrent much the way "The Club" is a visual deterrent that can still keep a car from bei…

When you properly encrypt server passwords, they are not supposed to be decrypt-able. Whereas, this is supposed to be a two-way encryption as you need to access the raw data. Ergo, any form of encryption you can do can be easily undone and thus rendering your efforts moot.

http://en.wikipedia.org/wiki/Salt_(cryptography)

Re: Samsung Galaxy S3 stores passwords in plain text

#25

Post by jamesbrennan »

bigiain wrote: post #21
ricardobeat wrote: post #17

Earlier quoted context omitted.

It is bad either way. The phone should keep an access token (which can be revoked), not store the user's password.

That's a great plan - we now just need to convince every website and web service (and whatever else your phone authenticates with) to update their authentication method to use these access tokens. So are you going to phone Apple and ask them to change their website/ITMS/iCloud/DeveloperCenter password/authentication system? No? Neither am I. Samsung storing the passwords in cleartext is lazy, but if the assumption is…

Passwords are not included in iPhone backups. When you restore from a backup, you are prompted for wireless network passwords, for example, that the phone would have just connected to before the backup/restore.

Re: Samsung Galaxy S3 stores passwords in plain text

#26

Post by drivebyacct2 »

SoftwareMaven wrote: post #6

This is a really bad article. I would call it nothing less than fear-mongering. Let's say they decided to encrypt the file. They would have to store that key in plain-text somewhere. Of course, they could encrypt that, but then that key would have to be stored somewhere. No matter how they decided to store the password, if somebody has root access to the device, they can find a way to read it. If they can't find a wa…

The correct way for them to handle this was to defer to AccountManager and allow Android to handle the Google authentication.

Similarly, users should not give credentials to 3rd party applications. I would not give Samsung my Gmail login, nor would I give it to Facebook to let them scrape contacts.

Re: Samsung Galaxy S3 stores passwords in plain text

#27

Post by jayfuerstenberg »

charlesju wrote: post #24
jayfuerstenberg wrote: post #23

Earlier quoted context omitted.

The decryption keys aren't just sitting out in the open so any amount of encryption is better than none. This is like asking why would we encrypt data on a server since the decryption keys are accessible. Of course they are, they're needed to decrypt the data. But at least it takes more time to find the keys and that "can" be a deterrent much the way "The Club" is a visual deterrent that can still keep a car from bei…

When you properly encrypt server passwords, they are not supposed to be decrypt-able. Whereas, this is supposed to be a two-way encryption as you need to access the raw data. Ergo, any form of encryption you can do can be easily undone and thus rendering your efforts moot. http://en.wikipedia.org/wiki/Salt_(cryptography)

I understand one way hashing but what about DB passwords for instance? You need access to plaintext passwords.

This is getting long but the point is plaintext = he worst thing you can do. Even ROT13 is a little better.

Re: Samsung Galaxy S3 stores passwords in plain text

#28

Post by Cadsby »

jamesbrennan wrote: post #25
bigiain wrote: post #21

Earlier quoted context omitted.

That's a great plan - we now just need to convince every website and web service (and whatever else your phone authenticates with) to update their authentication method to use these access tokens. So are you going to phone Apple and ask them to change their website/ITMS/iCloud/DeveloperCenter password/authentication system? No? Neither am I. Samsung storing the passwords in cleartext is lazy, but if the assumption is…

Passwords are not included in iPhone backups. When you restore from a backup, you are prompted for wireless network passwords, for example, that the phone would have just connected to before the backup/restore.

Depends if you encrypt your backups or not. If so, passwords are restored to the device along with the rest of your data.

Re: Samsung Galaxy S3 stores passwords in plain text

#30

Post by jrockway »

smegel wrote: post #13
SoftwareMaven wrote: post #6

This is a really bad article. I would call it nothing less than fear-mongering. Let's say they decided to encrypt the file. They would have to store that key in plain-text somewhere. Of course, they could encrypt that, but then that key would have to be stored somewhere. No matter how they decided to store the password, if somebody has root access to the device, they can find a way to read it. If they can't find a wa…

> They would have to store that key in plain-text somewhere. Is this really true? Could not the device manufacturer store embed the key in silicon somehow, perhaps in EEPROM or similar?

Yes, they could use the TPM/Secure Element, but that really only protects against attacks where the memory is removed from the device and the device is lost. (Unless you want to require the user to enter a PIN each time they want a password; then a hardware-based solution provides reasonable security.)
Post reply on HN