search

google / google-authenticator-android

Open source fork of the Google Authenticator Android app
https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2
Apache License 2.0
1.6k stars 471 forks source link

Secrets should be stored in a java.security.KeyStore #48

Open ThomasHabets opened 8 years ago

ThomasHabets commented 8 years ago

Transferred from https://github.com/google/google-authenticator/issues/157

Instead of storing the secrets in the SQLite database, the SQLite database should store the alias of the SecretKey in a java.security.KeyStore. This will allow migration to more secure methods of storage in the future.

Note that you'll have to use a JCEKS instead of the default JKS.

capi commented 8 years ago

How should the password for the keystore be protected? For the mentioned use-case where Authenticator is installed on SD-card, having a hard-coded password or one that is also stored on the SD-card would not yield any additional security.

Manouchehri commented 8 years ago

@capi The Android Keystore does not store passwords on an SD card in any situation as far as I'm aware.

https://developer.android.com/training/articles/keystore.html

It's much more than just a hardcoded password. On devices with hardware backed keys, extraction becomes difficult.

capi commented 8 years ago

@Manouchehri Thanks for the clarification, my mind was set way to much to the standard Java keystore.

scottmmjackson commented 5 years ago

I'm guessing that not using the Android keystore was why I was able to recently restore Google Authenticator from a Titanium Backup with all my tokens intact.