Android - Storing a PIN/Password

Question

The application in mind has a custom keypad. A GridLayout of 9 buttons with number 1-9. The user will press 4 buttons, then 'enter' to initially create the PIN and then to verify thereafter.

Is there a built-in way where this 4 digit PIN can be stored (encrypted) and retrieved?

How do most applications do this?

As a simple solution, would hashing this PIN and storing it in the preferences suffice?

Answer 1

You could use this library to store the PIN in SharedPreferences safely.

Add this to your build.gradle

dependencies {
    compile 'com.scottyab:secure-preferences-lib:0.1.4'
}

Then access the the SecurePreferences file

SharedPreferences prefs = new SecurePreferences(context, null, "my_custom_prefs.xml");

From here you can load and save to the preferences like normal

SharedPreferences.Editor editor = prefs.edit();
editor.putInt("userPin", pin).commit();

int pin = prefs.getInt("userPin", default);

Disclaimer from the library:

By default it's not bullet proof security (in fact it's more like obfuscation of the preferences) but it's a quick win for incrementally making your android app more secure. For instance it'll stop users on rooted devices easily modifying your app's shared prefs. Recommend using the user password based prefs as introduced in v0.1.0.