1

There is a common requirement of storing user credentials securely (user id / user password) in the App and use them automatically next time the App starts, but I'm not being able to figure out how to do this without user interaction.

Using JSON Store I need a password to encrypt the information, so if I store user credentials in the JSON Store I will need to ask to the user for the password used to encrypt the information.

A solution I figure out is to store the user id in a JSON Store without encryption and the password in a JSON Store encrypted with the user id as password. May be this solution provide a bit more security than not to encrypt anything but I think is not a complete solution.

As explained in the comments this is a really bad idea.

Is there any solution to store user credentials securely and recover them without user interaction?

Jxadro
  • 1,497
  • 2
  • 16
  • 36
  • 2
    _"May be this solution provide a bit more security than not to encrypt anything"_ Nope. It's as secure as locking your door but leaving the key in front of it. – Carsten Aug 26 '14 at 09:24
  • Ok, I supposed that. Any comment about how to store user credentials securely and recover them without user interaction? Is it possible? – Jxadro Aug 26 '14 at 10:03
  • FYI - I updated my answer below with some suggestions. – cnandreu Aug 28 '14 at 13:09

1 Answers1

2

You can use the Keychain API on iOS. Android doesn't seem to have an equivalent API.

The most complete solution I figure out is to store the user id in a JSON Store without encryption and the password in a JSON Store encrypted with the user id as password. May be this solution provide a bit more security than not to encrypt anything but I think is not a complete solution.

I would strongly advise against doing that, if you store the encryption key (the user id) in plain text, then the attacker can simply use that to get to the password.

Update (Aug 27, 2014)

You should consider:

  • Hashing - You could hash values you want to protect. These are one-way functions, so you can't get the password back once you hash it. However, you can verify that the user provided the correct password. For example: First login you store( hash(password) ) then on next logins you compare if hash(password_provided) == stored_password_hash. If it matches, the user provided the same password. You should also use a salt.

  • You could give the user the ability set a pin using some library like ABPadLockScreen (you could probably find or implement something similar for Android too). You can then use the pin as the PBKDF2 input to generate an encryption key (JSONStore will do this for you when you pass the pin as the password). I would advise in favor of letting users only try a small amount of incorrect pin numbers, especially if the pin is only numeric and short, that way they can't easily guess the pin by trying various combinations. The idea here is that a pin will be easier to remember and type than their password.

FYI - There's a Stack Exchange site similar to StackOverflow but for security questions here.

Community
  • 1
  • 1
cnandreu
  • 5,113
  • 3
  • 25
  • 50