Android saves wifi passwords in plaintext to the cloud

Post by Afforess » Wed, Jul 17, 2013, 7:20 PM UTC

moxie wrote: post #122

enginous wrote: post #12

What key are you going to encrypt these passwords with? If you were to encrypt passwords in the cloud with a key that's stored on the device, you can't unlock the passwords on a different device (or the same device after flashing), which is the whole point of backing it up in the cloud. If you were to encrypt them with the user's Google Accounts password, the device would need to ask for that password on every startu…

One way to do it would be: 1) Your plaintext password is used to generate two derivative tokens. One for user authentication with Google, and one for encrypting data stored with Google. The authentication password token is PBKDF2(N, password) and the encryption token is PBKDF2(N-1, password). You give Google the authentication token on signup. They are not capable of deriving the encryption token from it, but the use…

Post by mik3y » Wed, Jul 17, 2013, 7:38 PM UTC

socillion wrote: post #130

mik3y wrote: post #112

Earlier quoted context omitted.

It's even easier to see how handy millions of wifi passwords might come in handy if you already have the information about the wifi networks you got from war-driving (street view). Do you have any idea what you're talking about? Talk to a real live Googler (they exist!). Any one of them will tell you that: (a) the war driving thing was one engineer's massive fuckup that was never wanted for any product, and the data…

I'm not sure what you're talking about. Google collects information on wireless networks for a very specific purpose - determining location to speed up or replace GPS. Skyhook Wireless is another company that sells the information obtained from wardriving. https://support.google.com/maps/answer/1725632?hl=en Are you saying this service was shut down despite all indications to the contrary, or are you disputing the me…

  In addition, given the concerns raised, we have
  decided that it’s best to stop our Street View
  cars collecting WiFi network data entirely. 

Post by amalter » Wed, Jul 17, 2013, 8:05 PM UTC

samstave wrote: post #77

leoedin wrote: post #61

Earlier quoted context omitted.

You give large corporations way too much credit. There's no evidence beyond your conspiracy theories that this is a feature designed for anything other than convenience (one which I and many others in the thread have found to be quite convenient). Not every feature in Android is designed to be monetised. Google develop Android with the intent that users will use their app store/click on Google provided ads. They can…

> You give large corporations way too much credit. There's no evidence beyond your conspiracy theories that this is a feature designed for anything other than convenience Yeah, excepting the whole NSA issue, the fact that Google was previously caught/accused of war-driving every wifi net they could see with their streetview cars etc. While the feature may be convenient, that does not preclude the worst case from also…

Post by MarkMc » Wed, Jul 17, 2013, 8:12 PM UTC

enginous wrote: post #12

What key are you going to encrypt these passwords with? If you were to encrypt passwords in the cloud with a key that's stored on the device, you can't unlock the passwords on a different device (or the same device after flashing), which is the whole point of backing it up in the cloud. If you were to encrypt them with the user's Google Accounts password, the device would need to ask for that password on every startu…

Post by nodata » Wed, Jul 17, 2013, 8:37 PM UTC

brudgers wrote: post #32

enginous wrote: post #12

What key are you going to encrypt these passwords with? If you were to encrypt passwords in the cloud with a key that's stored on the device, you can't unlock the passwords on a different device (or the same device after flashing), which is the whole point of backing it up in the cloud. If you were to encrypt them with the user's Google Accounts password, the device would need to ask for that password on every startu…

Horseshit. Setting up a password for an Android device only needs to be done once for each device->network pairing. The reuse of Wifi passwords across devices is an edge case given the predominate ownership pattern of Android devices - i.e. most people have a phone that runs Android and no other Android device. Google's scheme allows them to harvest the passwords to a vast number of wireless networks. Google has harv…