Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android saves wifi passwords in plaintext to the cloud

code.google.com

Post reply on HN
Print view View original

41–50 of 172 posts

Re: Android saves wifi passwords in plaintext to the cloud

#41

Post by eli »

Camillo wrote: post #30
enginous wrote: post #12

What key are you going to encrypt these passwords with? If you were to encrypt passwords in the cloud with a key that's stored on the device, you can't unlock the passwords on a different device (or the same device after flashing), which is the whole point of backing it up in the cloud. If you were to encrypt them with the user's Google Accounts password, the device would need to ask for that password on every startu…

Not backing up wifi passwords would be a better tradeoff, especially as the default.

I seem to recall that not backing up anything is the default. Am I wrong?

Re: Android saves wifi passwords in plaintext to the cloud

#43

Post by jotaass »

jmngomes wrote: post #23

This reply "This report applies to a mobile Google application or service, and the issue tracker where you reported it specializes in issues within the Open Source source code of the Android platform." is a bit off, IMO. The developer reported a bug found on Android to the Android forum. The reply he gets sounds like a dismissal, which is quite strange given that the problem is not only related to Android but also wi…

I too found the replies to be somewhat dismissive. You would think this sort of report would be dealt with much more urgency or, in the very least, some concern.

It's an important problem, and the feeling I get from that thread is that they are more concerned where the bug should be filled. I appreciate organization as much as anyone, but the proper response should be frantic running around and hair pulling.

Re: Android saves wifi passwords in plaintext to the cloud

#44

Post by damian2000 »

eli wrote: post #41
Camillo wrote: post #30

Earlier quoted context omitted.

Not backing up wifi passwords would be a better tradeoff, especially as the default.

I seem to recall that not backing up anything is the default. Am I wrong?

I believe cyanogenmod has backup turned off. But I had used previous (earlier version) of Android and it was turned on.

Re: Android saves wifi passwords in plaintext to the cloud

#45

Post by untog »

brudgers wrote: post #32
enginous wrote: post #12

What key are you going to encrypt these passwords with? If you were to encrypt passwords in the cloud with a key that's stored on the device, you can't unlock the passwords on a different device (or the same device after flashing), which is the whole point of backing it up in the cloud. If you were to encrypt them with the user's Google Accounts password, the device would need to ask for that password on every startu…

Horseshit. Setting up a password for an Android device only needs to be done once for each device->network pairing. The reuse of Wifi passwords across devices is an edge case given the predominate ownership pattern of Android devices - i.e. most people have a phone that runs Android and no other Android device. Google's scheme allows them to harvest the passwords to a vast number of wireless networks. Google has harv…

an act which can be in no way cast as user convenience.

It's very convenient to me. I have both an Android phone and tablet. I've also switched Android phones multiple times- it's been quite gratifying to return to a city I visited three years ago and have it automatically connect to the WiFi hotspots I used back then.

Re: Android saves wifi passwords in plaintext to the cloud

#46

Post by claudius »

enginous wrote: post #12

What key are you going to encrypt these passwords with? If you were to encrypt passwords in the cloud with a key that's stored on the device, you can't unlock the passwords on a different device (or the same device after flashing), which is the whole point of backing it up in the cloud. If you were to encrypt them with the user's Google Accounts password, the device would need to ask for that password on every startu…

Let the user create a private/public key on the device and allow them to store the file somewhere safe with only the public key remaining on the device. It can then easily do the backup (and even store the public key on Google’s servers, if required) whenever required, and if the user gets a new phone, he’ll be prompted to feed his private key into it again to decrypt the backup. This can be done over the network, from an SD card/usb key or maybe even with a QR code.

Re: Android saves wifi passwords in plaintext to the cloud

#47

Post by vegasbrianc »

Symmetry wrote: post #40
brudgers wrote: post #32

Earlier quoted context omitted.

Horseshit. Setting up a password for an Android device only needs to be done once for each device->network pairing. The reuse of Wifi passwords across devices is an edge case given the predominate ownership pattern of Android devices - i.e. most people have a phone that runs Android and no other Android device. Google's scheme allows them to harvest the passwords to a vast number of wireless networks. Google has harv…

I'd imagine people getting new phones is the common use case.

or a factory reset.

Re: Android saves wifi passwords in plaintext to the cloud

#48

Post by shameless_1 »

brudgers wrote: post #32
enginous wrote: post #12

What key are you going to encrypt these passwords with? If you were to encrypt passwords in the cloud with a key that's stored on the device, you can't unlock the passwords on a different device (or the same device after flashing), which is the whole point of backing it up in the cloud. If you were to encrypt them with the user's Google Accounts password, the device would need to ask for that password on every startu…

Horseshit. Setting up a password for an Android device only needs to be done once for each device->network pairing. The reuse of Wifi passwords across devices is an edge case given the predominate ownership pattern of Android devices - i.e. most people have a phone that runs Android and no other Android device. Google's scheme allows them to harvest the passwords to a vast number of wireless networks. Google has harv…

> Google has harvested the location, name and signal strength of many millions of wireless networks across the world

Don't forget that that dataset of wireless locations is updated continuously through crowdsourcing.

Re: Android saves wifi passwords in plaintext to the cloud

#49

Post by swamp40 »

brudgers wrote: post #32
enginous wrote: post #12

What key are you going to encrypt these passwords with? If you were to encrypt passwords in the cloud with a key that's stored on the device, you can't unlock the passwords on a different device (or the same device after flashing), which is the whole point of backing it up in the cloud. If you were to encrypt them with the user's Google Accounts password, the device would need to ask for that password on every startu…

Horseshit. Setting up a password for an Android device only needs to be done once for each device->network pairing. The reuse of Wifi passwords across devices is an edge case given the predominate ownership pattern of Android devices - i.e. most people have a phone that runs Android and no other Android device. Google's scheme allows them to harvest the passwords to a vast number of wireless networks. Google has harv…

> Google's scheme allows them to harvest the passwords to a vast number of wireless networks.

I wasn't too worried until I read this from you.

Re: Android saves wifi passwords in plaintext to the cloud

#50

Post by durkie »

I know it doesn't really address the issue at hand, but as an alternative here Android features a little-documented local backup feature that can be done through adb, and can be encrypted.

Even google's official adb page has no mention of it, but I've done it and it works fine: http://tutznet.com/1283-perform-full-backup-android-phone-ad... (not my blog -- just the least spammy site i could find)

Post reply on HN