0

I'm creating an android app which requires a login process. My issue is with implementing a "remember me" function in the app. There are several questions surrounding this issue already on the internet, but I was wondering if there is an easier way than creating public keys for the app or using OAuth (disclaimer: novice developer).

I read the existing questions like How do I implement a 'Remember me' function in an Android Activity? and Security: How should I store ("Remember") a user's username and password for future use? but they suggest two methods of password storage: plaintext in SharedPreferences, or hashed in SharedPreferences. However, the answers go on to say that these can be compromised if someone has access to the phone.

As a preliminary question, I would ask whether it is necessary to maintain security once someone has root access to the device/the hashed password, considering that cracking the password may give the intruder access to other accounts the user has made. If so, would it be beneficial to implement a system which performs this function but without ever storing the user's password (plaintext or hashed) on the phone.

I was thinking of a method which works using three steps:

  1. When a user successfully logs in AND has checked the "remember me" checkbox, store their username in a SharedPreferences file.
  2. Store a boolean value in the database indicating whether the user has checked the "remember me" box.
  3. When the app starts in future, it automatically checks the SharedPreferences file for a username. If a username is found, and the database value for that username is true, the user is logged into the app under that user name.

This way, the user's password is never stored on the app (either in cleartext or in hashed form). Would this be a secure way of implementing the "remember me" function, or should I use another method?

Apologies if this question is not specific enough/too open-ended.

Community
  • 1
  • 1
fear7
  • 81
  • 6
  • I am currenctly working on the same kind of app with the same need of "Remember me" function. I did the same thing as you with storing only the user name in SharedPreferences. The problem is when the user looses the phone. But in this case you either always ask for the user password which would be safer, or never and really have a remember me function.. – Bastien Viatge Jul 27 '15 at 08:46
  • 1
    Also you can add passwordChangedDate on your external DB, also save the date of the checked "remember me" box. In that way, even if he lost's his mobile phone, he can change the password and then it would be ok. – gmetax Jul 27 '15 at 08:48

1 Answers1

0

As you do not store password in phone I think it's a secured way of implementing a "Remember Me" function. But, In your 3rd step you haven't mentioned how you will get the username to compare with the SharedPreferences. If users have to provide the username again it won't be a good method.

Anisuzzaman Babla
  • 6,510
  • 7
  • 36
  • 53