Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android account passwords are stored on disk in plain text

code.google.com

Post reply on HN
Print view View original

91–93 of 93 posts

Re: Android account passwords are stored on disk in plain text

#91

Post by teoruiz »

crocowhile wrote: post #78
drivebyacct2 wrote: post #26

Earlier quoted context omitted.

No. No it's not. please tell me how someone is going to get those passwords without root. (hint, they're not) additionally, how is this different than NY laptop with Pidgin accounts, my IMAP client, Firefox's stored passwords, etc.

Actually Android phones cannot use two way authentication so after you enable it in google account you will have to create an application specific password: that means that your android phone will login to google account using your usual username and a "per application" password randomly generated by google. That is the one that is stored in the sql db. All google has to do is to make sure that you cannot login using…

You just have to revoke the "per application" password you used on your phone.

My iPad 2 was recently stolen (sad face) and I just had to revoke the different passwords I used for the different apps (Reeder, Mail, Safari, etc.).

Re: Android account passwords are stored on disk in plain text

#92

Post by nightpool »

lotu wrote: post #66
st3fan wrote: post #46

Earlier quoted context omitted.

Cleartext passwords are perfectly fine in this case. I speak as a software engineer specialized in security. These passwords should of course be stored in a Keychain-like component that the OS provides. Are you sure you are specialized in security?

The OS can't provide a key ring because the user dosen't use a password to login. Or if they do have an unlock code they are short and numeric, making brute forcing them trivial. So yes, in this case plain text is acceptable because there is no truly better alternative.

On one hand, both gesture unlock codes and longer alphanumeric codes, both of which android supports, would probably make good candidates to secure the key ring with. On the other hand, the email application, for example, still needs to receive email even when the screen is off, which makes anything entered on screen un-lock a bad candidate for key-ring solutions. Boot is better, but how often do you turn your phone off while not using it?
Post reply on HN