如何在Android上安全存储商店敏感日期？

Question

I need to have an option to store an authentication key or password for an application that communicates over an SSH tunnel. What would be the most secure way of storing this without requiring the user to input an key.

Can I get something unique and secret from the users google account to use as encryption key for the stored preferences? That way a malicious party would need access to both the users google account and encrypted preferences in order to do any harm.

Answer 1

SharedPreferences are basically like cookies, and they are widely used for authentication. Use password only for first authentication, later use generated token.

In case you worry someone will lose their phone, you could add option to remotely destroy data or encrypt it with password, though reverse hash is possible.

Answer 2

It sounds like Google OAuth would be perfect for your situation, in combination with storing a user token in sharedpreferences and using SSL.

If the user device is compromised by a malicious party that obtains root then you should assume they've retrieved any tokens on the device. That said, tokens usually have a finite period of validity and can be revoked if you suspect they've been compromised.

A similar question was already asked on SO for which there's a pretty good answer .