Android Question Handling Credentials, username ,password should not be stored on the device

[Daniel-White]

I had been reading this http://developer.android.com/intl/es/training/articles/security-tips.html

Specifically this:
/******
Handling Credentials
In general, we recommend minimizing the frequency of asking for user credentials—to make phishing attacks more conspicuous, and less likely to be successful. Instead use an authorization token and refresh it.

Where possible, username and password should not be stored on the device. Instead, perform initial authentication using the username and password supplied by the user, and then use a short-lived, service-specific authorization token.

Services that will be accessible to multiple applications should be accessed using AccountManager. If possible, use the AccountManager class to invoke a cloud-based service and do not store passwords on the device.

After using AccountManager to retrieve an Account, CREATOR before passing in any credentials, so that you do not inadvertently pass credentials to the wrong application.

If credentials are to be used only by applications that you create, then you can verify the application which accesses the AccountManager using checkSignature(). Alternatively, if only one application will use the credential, you might use a KeyStore for storage. /*******


Is it good idea to use "KeyStore", How can I access or use it in B4A?. I am not happy to put an example the password of my FTPs username and password only obfuscated in my code.
I am not willing to use Oauth o tokens etc for this scenario.

About KeyStore http://developer.android.com/intl/es/reference/java/security/KeyStore.html
and http://developer.android.com/intl/es/training/articles/keystore.html

Any light will be very appreciated, I had been reading in the forums, and apparently, all of us have the same concern.

 

[Erel]

It is impossible to securely store a password in the APK.

A hacker can always run your program with a debugger and check the value just before it is being sent to the FTP server. It doesn't really matter where the password came from. Of course that obfuscating the password (process global strings are obfuscated) is better than doing nothing.

For better security you need a more complicated solution and avoid connecting directly to the FTP server (or create a unique password for each client).

 

[Informatix]

It is impossible to securely store a password in the APK.

Not really. The guides and libraries of my ProBundle provide a secure solution. Not ultimate but enough for the vast majority of cases.

A hacker can always run your program with a debugger and check the value just before it is being sent to the FTP server.

True if you don't use my solution. To run an external debugger, you have to add the Debuggable flag to the manifest and thus alter the APK. With my solution, this results in a app that no longer works, so there's nothing to debug.

 

[Erel]

In the case of FTP (unlike SFTP or FTPS) it is even simpler to get the user name and password as they are not encrypted. Any network monitor will show the credentials.

 

[Daniel-White]

In the case of FTP (unlike SFTP or FTPS) it is even simpler to get the user name and password as they are not encrypted. Any network monitor will show the credentials.

Yes, totally agree , specifically with sniffers like "Ettercap" We don't need, modify the configuration in the switches. (That mean, put a mirror port and put the switch to work like the Hubs devices) , that mean, the network administrator can only detect the ARP poisoned, using IDS like Snort. the attacker don't need touch the configuration inside of the switches . The risk is sooooooooooo high, and it is so easy to use the Ettercap. Indeed it can inject packets too. very funny tool. It work very well. Wireshark sniffer, need the admin of network to modify the ports in the switches. So Ettercap is very special.

I am still thinking how to work around this situation, How to avoid leave in hard code the username and password. I had the idea to put only the username in hard code and use HTTPS to ask or retrieve from web the password for that specific user, but it will be safe of any sniffer "man in the middle attack" etc, but the hacker can debug anyway the target variable in the phone anyway . the only benefit, I can change the password quickly, another approach Oauth can't help here. I think

The idea is use only one username and password to allow access to special FTPs folder in my Website.
The Informatix solutions will help in this scenario.


Hence about this https://security.web.cern.ch/security/recommendations/en/password_alternatives.shtml
I am looking to do something with "Hash users' passwords:" or something like Gmail is doing with tokens. My understanding the Gmail APP does not save the password, only username, it is similar to Oauth.

I will keep in touch, if I find a solution I will write here to help others too. Anyway, I would like to put an extra layer with the Informatix ProBundle in the near future.

Thanks Erel.