如何在Android设备上安全保存SharedPreference？

Question

I have a few SharedPreferences that I would like to save on the device itself as securely as possible. I know nothing about security but I found from a bit of research that what I want is something called an "obfuscator". Is that right? Is that different from "encryption", or do I want to do both? I've also found that I can use AESObfuscator or ProGuard . What are the differences? Are there even more options? Which should I use?

I'm obviously very new to security so any tutorials or other references would be helpful.

Answer 1

An Obfuscator will do nothing for you in this situation, as all it does essentially is rename variables to non-human readable names.

What you are going to want to do is encrypt the data as it is saved into your SharedPreferences and un-encrypt it when you read it from them.

An example of this idea Encrypted SharedPrefs , i can not speak for how effective it is i have not used above before.

Answer 2

The linked AESObfuscator encrypts strings with a static key, so that they can be saved to shared prefs and it is not immediately obvious what they are. This is different from a code obfuscator such as ProGuard, which mangles method and variable names in your code to make it harder to reverse-engineer. It is called 'obfuscation' and not 'encryptoin' because the key is in the app, and it is fairly easy to reverse (by extracting the key and decrypting). Shared prefs obfuscation will make it harder to read and modify the strings, but not impossible. If you are OK with that level of protection, do use this method. Using code obfuscation is also a good idea, so you'd want to use both.

The only supported way to make it 'impossible' to decrypt the strings is to have the user enter a password each time they use the app and derive the encryption key from it. This works, but is, needless to say, not very user friendly. If you are interested, here are some details .

Answer 3

I did some research about this problem when I needed to "hide" some URLs in Java files. In your case it will be some sort of secret key to encrypt your Strings. There is the problem that whole code in Java/Android can be read by anyone using some sort of reverse engineering. Sometimes it's pretty easy and obfuscators like ProGuard make it little bit harder. So your encrypting key will be visible to anyone. There are some (paid) obfuscators which can hide even Strings in Java files, but I'm not sure how solid they are.
In short - save your Strings outside of the device on your server and use some sort of secure connection between your device and server (SSL). Or you can ask your server to crypt it and send it back to you. If you save your secret key on the device you can be never sure if someone will use reverse engineering to read it.

Answer 4

The only secure way is not to keep any sensitive information on the device - if it is there, it will be extracted, provided its value is more than time of somebody who does work (and skilled kids in 3rd world country are really cheap, in terms of money and rich on time). You may look how this is done with OAuth - this technology allows to login 3rd party apps (for example) to twitter without compromising security credentials (or app ever seeing them)

One good library is: http://code.google.com/p/oauth-signpost/