Provide 4-pin password protection to android app

Question

I would like to add 4-pin password protection to my android app, something like in Evernote app.. The user should have an option to enable or disable the password protection. But I have no idea where to start...

1. Layout: I want four boxes that accepts only numbers.May be using editText is an option. But i'm not quite sure about the keypad.

2. Password storage: Would using shared preferences work?

3. How to add an option to reset password? Should i make a small webservice for it? However my application doesn't use internet,more like a calculator. I'm using sqLite to store data.

   Could somebody brief the steps I should follow? My questions may be silly, but i'm completely new in android and i'm helpless. Would appreciate your response. Thank you

Answer 1

You just need two screens, One for setting the password, the other which opens everytime user opens the app

1. In the first screen, use four edittexts horizontally with custom background, that will make them rectangular in shape (one example is this), set the input type "numberPassword", this will open the number pad and accept passwords.. Also limit the number of characters in each edittext as 1.. Once user is done entering value in all edittexts, combine them.

   String pass= editText1.getText().toString()+editText2.getText().toString()+.. and so on
   

And store in sharedpreferences:

SharedPreference sp=getSharedPreference("password",pass);

2. Make the same layout in second screen and when user is done entering value, again combine all the four and check with the one you stored in SharedPreference.. eg:

   if(editText1.getText().toString()+editText2.getText().toString()
   +.. and so on).equals(sp.getString("password",""){
          //Intent to your main activity
     }
   
     else{
      Toast.makeText(getApplicationContext(),"Incorrect Password",Toast.LENGTH_LONG).show();
     }
   

Answer 2

I dont like the answers above. You save the pin-string unencrypted with shared preferences, you should look for a method to encyrpt the string und decryp every time you ask the user to enter it. Shared preferences are not save, with physical access to the phone it's possible to read the pin out easily. What is the most appropriate way to store user settings in Android application

"The only area of concern here is what you're saving. Passwords are always a tricky thing to store, and I'd be particularly wary of storing them as clear text. The Android architecture is such that your application's SharedPreferences are sandboxed to prevent other applications from being able to access the values so there's some security there, but physical access to a phone could potentially allow access to the values."

I used BCrypt to save my pin securely. Simple to handle:

String hashpw=BCrypt(yourstring,BCrypt.gensalt());

Then save that string as usually in your sheared preferences.

To verify/enter pin just make:

If(BCrypt.checkpw(inputString,yourSharedPreference)){
//open app
}
else{
//acces denied toast
}