Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android account passwords are stored on disk in plain text

code.google.com

Post reply on HN
Print view View original

11–20 of 93 posts

Re: Android account passwords are stored on disk in plain text

#11

Post by markbao »

daeken wrote: post #8
markbao wrote: post #6

Well, what's the right way to encrypt this kind of stuff? Even if you're doing some kind of public-key cryptography, you're still going to have to store the private key at some location on the device, to decrypt the password for IMAP/SMTP/whatever authentication. Is there some foolproof way to do this that I'm not aware of? How are you supposed to store a password for future retrieval, not in plain text or basically…

You derive a key from some piece of user input and use that to encrypt it. If you also mix in, say, a hardware ID, then you also make it impossible to distribute a set of common keys.

Right, but even if you did that, wouldn't you still have to store that key somewhere?

Also, hi from downstairs!

Re: Android account passwords are stored on disk in plain text

#12

Post by rjd »

Incubus wrote: post #5

The title should probably mention that it only effects email. Comment #48 explains the reasoning behind it, and frankly seems perfectly reasonable.

The problem there is email is generally used as an authentication authority for most online services, and a stolen phone hands over exactly what organised criminal outfits need to begin start real indentity theft.

Having done some work with financial services this was a huge problem, as soon as an email acocunt is compromised hackers used automatic services to reset every password they can find... because the email was the point of authority.

Because of this the product we designed had a two point authority process. But alas the second point was a text message sent to the stored cellphone number, which would mean in this case all your data is pwned.

I see most banks I deal with now have moved to phone call only authority checks. But in all honest once you have access to a decent a email account you can harvest the needed information quickly. My current banks just wants name, access code (printed on my card FFS), birthday, mailing address and bingo I'm in.

Re: Android account passwords are stored on disk in plain text

#13

Post by daeken »

markbao wrote: post #11
daeken wrote: post #8

Earlier quoted context omitted.

You derive a key from some piece of user input and use that to encrypt it. If you also mix in, say, a hardware ID, then you also make it impossible to distribute a set of common keys.

Right, but even if you did that, wouldn't you still have to store that key somewhere? Also, hi from downstairs!

1) Assuming a virgin device, applications can't access the DB this stuff is stored in, or other applications' files (if an application wants to safely store stuff on its own, outside of the OS mechanisms), so it's not too big a concern that applications be unable to do this.

2) If you get physical access to the device, you can pull the DB and whatever IDs are involved. Without encryption, this is game over instantly; with encryption, your goal is to delay it as long as humanly possible.

Re: Android account passwords are stored on disk in plain text

#14

Post by [deleted] »

daeken wrote: post #13
markbao wrote: post #11

Earlier quoted context omitted.

Right, but even if you did that, wouldn't you still have to store that key somewhere? Also, hi from downstairs!

1) Assuming a virgin device, applications can't access the DB this stuff is stored in, or other applications' files (if an application wants to safely store stuff on its own, outside of the OS mechanisms), so it's not too big a concern that applications be unable to do this. 2) If you get physical access to the device, you can pull the DB and whatever IDs are involved. Without encryption, this is game over instantly;…

[deleted]

Re: Android account passwords are stored on disk in plain text

#15

Post by rjd »

mrb wrote: post #2

Cleartext passwords are perfectly fine in this case. I speak as a software engineer specialized in security. This bug report was filed by someone who doesn't understand that obfuscating a password is different from encrypting it. No matter how you store it, the application must be able to extract a cleartext password from whatever storage options are available on the Android device. For a longer explanation: http://d…

Not when there is already a market harvesting data from stolen phones. I think you probably haven't considered the impact for the standard user around using email as a authentication authority point.

Its like a skeleton key to your personal data, and with that you can get access to financial services very quickly. Hence why a black market exists, and I garantanee there is already rooting kits out there designed to own that data in seconds.

BTW obfuscation is not a security measure, and IMO its shameful and irresponsible to perpetuate that myth.

Re: Android account passwords are stored on disk in plain text

#16

Post by cpeterso »

I am reminded of the Android "reboot" bug where every keystroke was sent to the foreground application and an invisible terminal running as root. Try sending a text message with the word "reboot" and your phone would instantly reboot!

http://www.zdnet.com/blog/burnette/worst-bug-ever/680

Re: Android account passwords are stored on disk in plain text

#17

Post by FaceKicker »

markbao wrote: post #11
daeken wrote: post #8

Earlier quoted context omitted.

You derive a key from some piece of user input and use that to encrypt it. If you also mix in, say, a hardware ID, then you also make it impossible to distribute a set of common keys.

Right, but even if you did that, wouldn't you still have to store that key somewhere? Also, hi from downstairs!

Couldn't you have something like:

key = hash(hardware serial number, user password)

And then store the key only in memory every time the user unlocks the phone and wipe it from memory when they lock their phone?

Re: Android account passwords are stored on disk in plain text

#18

Post by cHalgan »

I'm not security expert at all, so I have a question.

If I lock my phone using pin does it mean that my passwords and keys (mentioned in comment #48) are not encrypted using pin+some phone HW ID?

Also does encrypting my passwords and keys using pin+some phone HW ID really solves the problem?

Re: Android account passwords are stored on disk in plain text

#19

Post by daeken »

FaceKicker wrote: post #17
markbao wrote: post #11

Earlier quoted context omitted.

Right, but even if you did that, wouldn't you still have to store that key somewhere? Also, hi from downstairs!

Couldn't you have something like: key = hash(hardware serial number, user password) And then store the key only in memory every time the user unlocks the phone and wipe it from memory when they lock their phone?

Yep, that's pretty much it. Where 'hash' is PBKDF2 with a good HMAC function and 10k+ rounds.

Re: Android account passwords are stored on disk in plain text

#20

Post by walexander »

markbao wrote: post #11
daeken wrote: post #8

Earlier quoted context omitted.

You derive a key from some piece of user input and use that to encrypt it. If you also mix in, say, a hardware ID, then you also make it impossible to distribute a set of common keys.

Right, but even if you did that, wouldn't you still have to store that key somewhere? Also, hi from downstairs!

The correct answer is to use a TPM - Trusted Platform Module - for that key. Accessing the TPM itself requires a password, but the hardware prevents against bruteforce/dictionary attacks.
Post reply on HN