I am creating an app which is a password manager and all the data that user enter is stored in the SQLite database.
Will it be safe to keep the data in the database without any encryption so that no other application or other web attacks can access the database file in a non rooted phone?
And if it is not safe then what are the possible ways by which data can be stored safely in SQLite database?
-
With sqlCipher you can encrypt your database. It won't be safe to keep password in the database directly. Actually keeping passwords in the local database whether encrpyted or not is not safe.Burak Karasoy– Burak Karasoy2015-11-15 12:17:45 +00:00Commented Nov 15, 2015 at 12:17
Add a comment
|
2 Answers
The Android platform provides a convenient way to store preferences and even big files thanks to the SharedPreferences interface. Even if the data stored in these shared preferences is hidden in a masked directory, it is possible to retrieve the data easily if the device is rooted.
Consequently, if the information stored by the application is sensitive, it might be necessary to encrypt the data stored in the shared preferences. It is possible to do so in two ways :
Use a cryptographic library to encrypt/decrypt the values (and eventually the keys) of the SharedPreferences. There are many state of the art java cryptographic library javax.crypto, Bouncycastle2 and Concealed[3] Use a library providing a SharedPreferences wrapper. These libraries are very convenient as the developer does not have to care about which algorithm has to be used. Meanwhile, using these libraries can lead to a lack of flexibility and some of them are not using safe algorithms. Consequently they may not be trust to store very sensitive data. One of the most used libraries providing this kind of wrapping feature is SecurePrefences [4]. In you choose this solution, you can instantiate a SecurePreferences extending SharedPreferences in a very straightforward way : SecurePreferences securePreferences = new SecurePreferences(context, "MyPassword", null); SecurePreferencesExample.java hosted with ❤ by GitHub These two methods are based on symmetric cypher algorithm such as AES (with an appropriate key size). It leads to wonder : which key should-we use ? Indeed if we use a static key, the preferences can be decrypted by retro-engineering the application. So, the best solution would be to use a pin-code/passphrase that the user has to type when the application starts. Another possibility is to use the Fingerprint API [15] (available since API 23) which provides a safe and fluent way to authenticate. Unfortunately this approach cannot fits every application’s user experience. For instance if we want to display some information stored before the pin code is typed, then we cannot use this secure encryption system.
Hopefully Android provides a safe way to generate a key which will be unique for each couple application/device : the KeyStore. Android KeyStore’s goal is to allow applications to put private keys in a place where they cannot be retrieved by another application or by materially accessing the data stored on the device. The mechanism is pretty simple : the first time, you run your application to check whether a private key linked to your application is present or not. If not, you generate one and you store it in the KeyStore. If the private key is already present, you can use it as a cryptographically safe key to decipher a SharedPreferences data thanks to the algorithms described above. Obaro Ogbo wrote a detailed article [11] describing in depth how to use the KeyStore to generate a Private/Public Key couple. The main drawback of the KeyStore is that it is available only since API 18. Still, there is a backport library which provides compatibility since API 14 [14] (this not an “official” backport so you have to use it at your own risk).
Consequently we can propose the following decision diagram when deciding which type of preference system we should use:
Secure Preferences flowchart
3 Comments
Abhishek Anand
and what if the phone is not rooted?
FunkSoulBrother
Hacking the Android KeyStore is relatively easy on rooted devices. read more : androidauthority.com/…
JosephH
@FunkSoulBrother That article is very old now so I thought it worth adding an update - from Android 6.0 and onwards, you can use the 'isInsideSecureHardware' method to verify that the key are in inside secure hardware: developer.android.com/reference/android/security/keystore/… If the key is inside secure hardware, it's very very hard (probably for most purposes implausible) to extract without both physical access to the device and advanced tools.
why not to encrypt the password data ? The password information is too sensitive. I think you can try to use RSA algorithm, with a long key, 1024 bits at least.
