Android account passwords are stored on disk in plain text • Hacker News Board

Re: Android account passwords are stored on disk in plain text

#41

Post by zyb09 » Sat, Jul 23, 2011, 1:16 AM UTC

mrb wrote: post #2

Cleartext passwords are perfectly fine in this case. I speak as a software engineer specialized in security. This bug report was filed by someone who doesn't understand that obfuscating a password is different from encrypting it. No matter how you store it, the application must be able to extract a cleartext password from whatever storage options are available on the Android device. For a longer explanation: http://d…

The difference between Pidgin and Android is, Google provides the whole stack from the OS to the Mail App and also dictates hardware requirements. Clearly the can come up with a better way to store the, for many people, most important password they have.

Re: Android account passwords are stored on disk in plain text

#42

Post by ConstantineXVI » Sat, Jul 23, 2011, 1:17 AM UTC

chopsueyar wrote: post #33

wallflower wrote: post #22

Earlier quoted context omitted.

No, /data/data/* is protected (as it should be) on non-rooted phones. mediapc:platform-tools media$ ./adb shell $ ls /data/data opendir failed, Permission denied $

But if you have physical access to the phone, why couldn't you root it?

1) Official root methods (see `fastboot oem unlock`, as made famous by the Nexus phones) as well as many less official methods require a wipe, thus rendering this attack moot.

2) In the event your phone isn't covered by the situation in #1, having a passcode lock and not enabling ADB (developer mode) should be sufficient to protect from a root attack in most cases.

It's worth noting that you're still vulnerable to a root attack that doesn't wipe and can bypass your passcode (runs from fastboot/recovery, or a hole in the passcode lock itself); though I've yet to come across a phone personally with this situation.

And it goes without saying, if you've rooted your phone yourself, any OS security is null and void. If you're rooting, you should realize this already.

Re: Android account passwords are stored on disk in plain text

#43

Post by jrockway » Sat, Jul 23, 2011, 1:23 AM UTC

cryos wrote: post #24

grecy wrote: post #4

please fix!

No doubt you'll get the standard reply "Its open source the community should fix this".

The person who wants the software fixed should fix it. This isn't a cop-out, it's simple economics. If you want a pony, go buy a pony. Otherwise, STFU.

Re: Android account passwords are stored on disk in plain text

#44

Post by oomkiller » Sat, Jul 23, 2011, 1:26 AM UTC

The comments on this page are pure gold. So many people jumping on the bandwagon without a clue as to the actual security issues/solutions. Like this one:

  I personally think that delivering a quick update with MD5 encryption would be a fast patch for the moment.

Re: Android account passwords are stored on disk in plain text

#45

Post by eli » Sat, Jul 23, 2011, 1:26 AM UTC

cpeterso wrote: post #16

I am reminded of the Android "reboot" bug where every keystroke was sent to the foreground application and an invisible terminal running as root. Try sending a text message with the word "reboot" and your phone would instantly reboot! http://www.zdnet.com/blog/burnette/worst-bug-ever/680

That was a bug, this is a design decision.

Re: Android account passwords are stored on disk in plain text

#46

Post by st3fan » Sat, Jul 23, 2011, 1:33 AM UTC

mrb wrote: post #2

Cleartext passwords are perfectly fine in this case. I speak as a software engineer specialized in security. This bug report was filed by someone who doesn't understand that obfuscating a password is different from encrypting it. No matter how you store it, the application must be able to extract a cleartext password from whatever storage options are available on the Android device. For a longer explanation: http://d…

Cleartext passwords are perfectly fine in this case. I speak as a software engineer specialized in security.

These passwords should of course be stored in a Keychain-like component that the OS provides.

Are you sure you are specialized in security?

Re: Android account passwords are stored on disk in plain text

#47

Post by ENOTTY » Sat, Jul 23, 2011, 1:40 AM UTC

FaceKicker wrote: post #17

markbao wrote: post #11

Earlier quoted context omitted.

Right, but even if you did that, wouldn't you still have to store that key somewhere? Also, hi from downstairs!

Couldn't you have something like: key = hash(hardware serial number, user password) And then store the key only in memory every time the user unlocks the phone and wipe it from memory when they lock their phone?

If you do that, I'd imagine that the phone would not be able to pull updates from those services while the phone is locked.

Re: Android account passwords are stored on disk in plain text

#48

Post by spolsky » Sat, Jul 23, 2011, 1:44 AM UTC

supersillyus wrote: post #35

It's nice to bring interesting bugs to light, but I hate how posting links to bugs always results in a pile on of useless comments. It evens says "Each comment triggers notification emails. So, please do not post "+1 Me too!". Instead, click the star icon." next to the comment box, but people apparently think things like "please try to fix it , security on mobile devices need to be more powerful" are worth emailing 5…

I completely don't understand these public bug tracking systems that turn into YouTube threads, for all intents and purposes. How does any working engineer get anything done like that?

Re: Android account passwords are stored on disk in plain text

#49

Post by FaceKicker » Sat, Jul 23, 2011, 1:47 AM UTC

ENOTTY wrote: post #47

FaceKicker wrote: post #17

Earlier quoted context omitted.

Couldn't you have something like: key = hash(hardware serial number, user password) And then store the key only in memory every time the user unlocks the phone and wipe it from memory when they lock their phone?

If you do that, I'd imagine that the phone would not be able to pull updates from those services while the phone is locked.

Damn, good point. I'm out of ideas then. :)

Re: Android account passwords are stored on disk in plain text

#50

Post by wallflower » Sat, Jul 23, 2011, 1:53 AM UTC

oomkiller wrote: post #44

The comments on this page are pure gold. So many people jumping on the bandwagon without a clue as to the actual security issues/solutions. Like this one: I personally think that delivering a quick update with MD5 encryption would be a fast patch for the moment.

This is another epic thread (dated and not as relevant now) that may be entertaining to you...

"Issue 6914: Make android use the GPU (if available) for UI and browsing."

"I agree with the common opinion here... It is very hard to pitch Android to someone who is not tech savy, simply because of the choppy and sluggish UI. This has also become the talk of the masses, most people who haven't even used Android say the following: "I've seen Android, its cool, but its not as smooth and stable as the iPhone." The iPhone's hardware fails a lot (I've exchanged my 3Gs twice in less than a year), it also freezes at times and drops calls, but what do people see and remember!? UI!! If android wishes to ever compete seriously with iOS, GPU acceleration is a must!

On a side note, who cares about the older phones!? they can keep being sluggish... There's less than a handful of Android phones that won't support GPU acceleration, there's more than 30 that do...

Conclusion: MAKE THIS A PRIORITY, its time to put the choppy UI days behind us, this year is going to bring amazing hardware to the table, and the new iPhone is good, but not THAT good... As it stands, all iOS has on Android is a "smoother experience", why hesitate to fix it!?"

http://code.google.com/p/android/issues/detail?id=6914