Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Samsung Galaxy S3 stores passwords in plain text

geek.com

Post reply on HN
Print view View original

31–38 of 38 posts

Re: Samsung Galaxy S3 stores passwords in plain text

#31

Post by jrockway »

jayfuerstenberg wrote: post #27
charlesju wrote: post #24

Earlier quoted context omitted.

When you properly encrypt server passwords, they are not supposed to be decrypt-able. Whereas, this is supposed to be a two-way encryption as you need to access the raw data. Ergo, any form of encryption you can do can be easily undone and thus rendering your efforts moot. http://en.wikipedia.org/wiki/Salt_(cryptography)

I understand one way hashing but what about DB passwords for instance? You need access to plaintext passwords. This is getting long but the point is plaintext = he worst thing you can do. Even ROT13 is a little better.

Even ROT13 is a little better.

No it's not.

Re: Samsung Galaxy S3 stores passwords in plain text

#32

Post by ricardobeat »

bigiain wrote: post #21
ricardobeat wrote: post #17

Earlier quoted context omitted.

It is bad either way. The phone should keep an access token (which can be revoked), not store the user's password.

That's a great plan - we now just need to convince every website and web service (and whatever else your phone authenticates with) to update their authentication method to use these access tokens. So are you going to phone Apple and ask them to change their website/ITMS/iCloud/DeveloperCenter password/authentication system? No? Neither am I. Samsung storing the passwords in cleartext is lazy, but if the assumption is…

There is already a standard called OAuth, which Twitter, Facebook, Google and most services implement, and can offer tokens that do not expire. It's not just an idea, it's how thousands of apps already work.

Re: Samsung Galaxy S3 stores passwords in plain text

#33

Post by anothermachine »

aristidb wrote: post #14
yuliyp wrote: post #4

Earlier quoted context omitted.

Why is storing them encrypted locally any better? Someone with root has access to the decryption keys anyway.

It isn't. Storing passwords on a mobile device, unencrypted or encrypted, is just wrong. Fortunately authenticating with Google services requires neither.

Yeah, Google would never ship software where "Password is stored on disk in plain text" https://code.google.com/p/android/issues/detail?id=10809#c48

Re: Samsung Galaxy S3 stores passwords in plain text

#34

Post by nitrogen »

SoftwareMaven wrote: post #6

This is a really bad article. I would call it nothing less than fear-mongering. Let's say they decided to encrypt the file. They would have to store that key in plain-text somewhere. Of course, they could encrypt that, but then that key would have to be stored somewhere. No matter how they decided to store the password, if somebody has root access to the device, they can find a way to read it. If they can't find a wa…

If Android doesn't provide suitable password management facilities, they could use the wallet approach and encrypt the password wallet with a key derived from/protected by the user's unlock code.

Re: Samsung Galaxy S3 stores passwords in plain text

#35

Post by chmod775 »

archivator wrote: post #8
mtgx wrote: post #5

Earlier quoted context omitted.

Really? So device encryption is pointless then? Same for a jailbroken iPhone? That seems hard to believe.

This is not what's under debate here. Without device encryption , encryption of the passwords is useless, given root access, since the key is somewhere on the device as well. If anything, the only crime here is not using access tokens but storing the whole password. With device encryption , the situation changes slightly. Unlike iDevices, most (all?) Android phones don't come with a hardware encryption chip, so, give…

I don't see how a hardware encryption chip could keep me from installing a key logger via an insecure boot loader. What exactly does that chip even do?

Re: Samsung Galaxy S3 stores passwords in plain text

#38

Post by mentat »

dfox wrote: post #18
mentat wrote: post #11

Earlier quoted context omitted.

PBKDF2, it works for deriving keys to decrypt other things.

But still you need to have whatever you use as input into KDF accessible. Encrypting passwords that you still need to be able to send somewhere without additional user interaction simply does not have any security benefit. Full-device encryption does work, building separate encrypted credential store is mostly useless security by obscurity.

You can have an encrypted keystore which is opened by entering a password and using that derived key to decrypt the keystore. Firefox uses this with their "master password". You can cache the decrypted key according to some policy which doesn't necessarily result in it getting written to disk.

Also, down votes? Really?

Post reply on HN