Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android saves wifi passwords in plaintext to the cloud

code.google.com

Post reply on HN
Print view View original

71–80 of 172 posts

Re: Android saves wifi passwords in plaintext to the cloud

#71

Post by vectorpush »

jsnell wrote: post #51
brudgers wrote: post #32

Earlier quoted context omitted.

Horseshit. Setting up a password for an Android device only needs to be done once for each device->network pairing. The reuse of Wifi passwords across devices is an edge case given the predominate ownership pattern of Android devices - i.e. most people have a phone that runs Android and no other Android device. Google's scheme allows them to harvest the passwords to a vast number of wireless networks. Google has harv…

If you're going to dismiss an argument as "horseshit", you should perhaps offer a compelling alternative. Because your idea of what is going on is frankly ridiculous. It's easy to see the user-experience story for this. Upgrade your phone, buy a tablet, etc, and as by magic all 10 wifi networks you use work without any configuration. No need to type that 32-character nuisance of a WPA2 password again, etc. How lovely…

I agree that trusting google with wifi passwords is about as benign as it gets (especially if you already trust them with everything else) but the reason we encourage password encryption isn't because we don't trust the service provider, it's because we don't trust hackers or unethical employees. There are a lot of people who would love to get their hands on that data.

Re: Android saves wifi passwords in plaintext to the cloud

#73

Post by chrisrhoden »

flipperypokery wrote: post #66
jsnell wrote: post #51

Earlier quoted context omitted.

If you're going to dismiss an argument as "horseshit", you should perhaps offer a compelling alternative. Because your idea of what is going on is frankly ridiculous. It's easy to see the user-experience story for this. Upgrade your phone, buy a tablet, etc, and as by magic all 10 wifi networks you use work without any configuration. No need to type that 32-character nuisance of a WPA2 password again, etc. How lovely…

Most people really have 10 different WiFi networks? I have two. Home and work. Who has 10? Apple solved this by supporting local backups. My phone backs up to my computer. When I restore to a new device, the backup goes with it. When I set up a completely new device -- which happens only once every couple of years -- I set up WiFi again. I've never, ever, ever thought "oh wow, setting up WiFi is just So Hard! I wish…

This is also opt in, as part of the first boot process. It also makes it very clear what will be stored. The difference is that this is free.

Re: Android saves wifi passwords in plaintext to the cloud

#74

Post by untog »

gcb0 wrote: post #64
jusben1369 wrote: post #53

Earlier quoted context omitted.

Yes. I just upgraded from one Android phone to another. Was resigned to the tedious nightmare of setting up multiple WiFi connections again. This feature is fantastic. Not that that negates privacy issues but it is a massive user convenience.

You guys can't be serious. How many APs do you even have to use regularly? And slightly related, do you have two factor enabled on your email or is that the end of modern life convenience as well?

The hotspots I use "regularly" aren't actually the issue- I could certainly remember the passwords for them easily. But over time I've built up a huge network of hotspots that I wouldn't like to lose- that coffee shop I went to a few months ago? That hotel I stayed in last year? It's quite nice to have that just connect automatically.

And you're presenting a false dilemma here. Of course I'd prefer this information be encrypted. I was simply replying to the OP that stated WiFi saving could be in "no way cast as user convenience".

Re: Android saves wifi passwords in plaintext to the cloud

#75

Post by jmngomes »

DannyBee wrote: post #34
jmngomes wrote: post #23

This reply "This report applies to a mobile Google application or service, and the issue tracker where you reported it specializes in issues within the Open Source source code of the Android platform." is a bit off, IMO. The developer reported a bug found on Android to the Android forum. The reply he gets sounds like a dismissal, which is quite strange given that the problem is not only related to Android but also wi…

What was the bug you submitted? The thing about AOSP is exactly what JBQ said: It's meant for reports about open source parts of Android, not reports about Samsung's skin on top of it, etc. Most of the bugs submitted are not AOSP bugs (I know it's hard to believe, but i've done triage on it). They are bugs in some vendor's patches or changes to AOSP, which, for the most part, Google can do nothing about. It would be…

I submitted a bug stating that the OS' facilities for managing audio (i.e. AudioManager et al) weren't working according to the spec/docs, some classes would report an incorrect volume during a call. I only tested it on a Samsung phone, I didn't bother testing with other brands because breaking on Samsung would be bad enough for my/any Android app.

I understand what you say, but if it was the other way around my reply would have been something in the lines of "1) please confirm it by testing on another phone brand; 2) if it's specific to Samsung, here's the link to file the bug"

Re: Android saves wifi passwords in plaintext to the cloud

#76

Post by brudgers »

untog wrote: post #45
brudgers wrote: post #32

Earlier quoted context omitted.

Horseshit. Setting up a password for an Android device only needs to be done once for each device->network pairing. The reuse of Wifi passwords across devices is an edge case given the predominate ownership pattern of Android devices - i.e. most people have a phone that runs Android and no other Android device. Google's scheme allows them to harvest the passwords to a vast number of wireless networks. Google has harv…

an act which can be in no way cast as user convenience. It's very convenient to me. I have both an Android phone and tablet. I've also switched Android phones multiple times- it's been quite gratifying to return to a city I visited three years ago and have it automatically connect to the WiFi hotspots I used back then.

That's perhaps a 3rd standard deviation case for backing up WiFi passwords, but not plausibly for harvesting data on all Wifi networks including those in private dwellings.

And collecting data on every network was what I said could not be cast as user convenience, so it appears that my statement has been taken out of context and then strawmanned.

In no event, however, is it a case for storing those passwords as plaintext.

Re: Android saves wifi passwords in plaintext to the cloud

#77

Post by samstave »

leoedin wrote: post #61
brudgers wrote: post #32

Earlier quoted context omitted.

Horseshit. Setting up a password for an Android device only needs to be done once for each device->network pairing. The reuse of Wifi passwords across devices is an edge case given the predominate ownership pattern of Android devices - i.e. most people have a phone that runs Android and no other Android device. Google's scheme allows them to harvest the passwords to a vast number of wireless networks. Google has harv…

You give large corporations way too much credit. There's no evidence beyond your conspiracy theories that this is a feature designed for anything other than convenience (one which I and many others in the thread have found to be quite convenient). Not every feature in Android is designed to be monetised. Google develop Android with the intent that users will use their app store/click on Google provided ads. They can…

>You give large corporations way too much credit. There's no evidence beyond your conspiracy theories that this is a feature designed for anything other than convenience

Yeah, excepting the whole NSA issue, the fact that Google was previously caught/accused of war-driving every wifi net they could see with their streetview cars etc.

While the feature may be convenient, that does not preclude the worst case from also being true.

Facebook is convenient, but its pretty well proven now that the data conveniently stored within is harvested and mined by "infiltrators thereof"

Re: Android saves wifi passwords in plaintext to the cloud

#78

Post by ajross »

gcb0 wrote: post #63
enginous wrote: post #12

What key are you going to encrypt these passwords with? If you were to encrypt passwords in the cloud with a key that's stored on the device, you can't unlock the passwords on a different device (or the same device after flashing), which is the whole point of backing it up in the cloud. If you were to encrypt them with the user's Google Accounts password, the device would need to ask for that password on every startu…

Why do you even have to backup a password? It's idiotic from every way you look at it

Sorry, that doesn't make any sense. The specific use case here is unboxing a new phone, logging in, and having access to all of your standard networks without having to look up your wifi passwords. Clearly that has value to anyone who has ever used a new phone.

But to get to your core point: unless you have an amazing memory (unlikely) or reuse passwords (not unlikely, but, to borrow a term, "idiotic") you have to be storing those passwords somewhere. Password escrow certainly counts as "backup" by any normal definition of the term, although it has some extra requirements.

Re: Android saves wifi passwords in plaintext to the cloud

#79

Post by ollysb »

flipperypokery wrote: post #66
jsnell wrote: post #51

Earlier quoted context omitted.

If you're going to dismiss an argument as "horseshit", you should perhaps offer a compelling alternative. Because your idea of what is going on is frankly ridiculous. It's easy to see the user-experience story for this. Upgrade your phone, buy a tablet, etc, and as by magic all 10 wifi networks you use work without any configuration. No need to type that 32-character nuisance of a WPA2 password again, etc. How lovely…

Most people really have 10 different WiFi networks? I have two. Home and work. Who has 10? Apple solved this by supporting local backups. My phone backs up to my computer. When I restore to a new device, the backup goes with it. When I set up a completely new device -- which happens only once every couple of years -- I set up WiFi again. I've never, ever, ever thought "oh wow, setting up WiFi is just So Hard! I wish…

If you're in the habit of connecting wifi at cafes/bars etc. you can easily run past 10 (wow - just checked the list on my 18 month old laptop, it's currently 110 networks).

Re: Android saves wifi passwords in plaintext to the cloud

#80

Post by sixbrx »

chrisrhoden wrote: post #73
flipperypokery wrote: post #66

Earlier quoted context omitted.

Most people really have 10 different WiFi networks? I have two. Home and work. Who has 10? Apple solved this by supporting local backups. My phone backs up to my computer. When I restore to a new device, the backup goes with it. When I set up a completely new device -- which happens only once every couple of years -- I set up WiFi again. I've never, ever, ever thought "oh wow, setting up WiFi is just So Hard! I wish…

This is also opt in, as part of the first boot process. It also makes it very clear what will be stored. The difference is that this is free.

Do they mention that it will be unencrypted? I don't remember that, and I think I would have remembered that.
Post reply on HN