kovmarci86 / android-secure-preferences

Secure AES Encryiption decorated Android SharedPreferences implementation.
38 stars 16 forks source link

Grave security issues with the used encryption setup #13

Open patrickfav opened 5 years ago

patrickfav commented 5 years ago

Hi,

You state your code derives it's basic encryption logic from: http://www.java2s.com/Code/Android/Security/AESEncryption.htm (see: https://github.com/kovmarci86/android-secure-preferences/blob/master/secure-preferences/src/main/java/edu/gmu/tec/scout/utilities/Encryption.java)

This example has grave security issues, among others:

As I can see you avoid the first point, but still the other points are grave enough to make the whole scheme very unsecure.