How to keep passwords securely in android using shared preferences or sqlite database?

Question

I am building an app which generates a random password and you can keep it along with your other details such as username, website url, name etc.

Basically a password management thing.

Things to be stored:

When I am clicking on the save button, I wanted it to be saved somewhere locally. So that, I could retrieve them and display it in another activity.

Can I share those things in SharedPreferences for all those password entries securely? [By password entry, I meant the entire class ]

I have referred to something like ComplexPreferences [ http://blog.nkdroidsolutions.com/class-object-in-sharedpreferences/ ]

I've tried them because I had created a class containing all these data [title, url, username, password, notes]. But I cannot retrieve them properly using a recyclerview. I'm ending up with some error.

If it cannot be done with SharedPreferences, how can I do it with SQLite Database?

But how can I save them securely? I don't know much about security in Android.

Please guide.

Answer 1

The shared preferences and sqlite db both are secure for an extend only. It can be easily accessanle and can be modified even there are several apps available to edit the shared preferences and sqlite db in playstore . **

So i prefer not to store it locally

.you can use some kind of **algorithms and mechanisms to encrypt and decrypt the data that you are going to store locally. if the device is rooted then its a SERIOUS ISSUE

Answer 2

I still don't understand, why you need to save it locally? If only your application will be able to unlock data. In this case, only your application will have keys to working with this files.

For this example, you can easily work with SharedPreference with Private Mode. Furthermore, it's enough for most tasks. We using this option to save User's token, and it's Ok, for system. (If we talk about safety of this way, so you will have some risk for custom ROM, for Users, which manually flashed on device.)

If you need more complicated things, you can use sample, for using Android Keystore, with generating Key Pair, and saving data. For example you can check this source.

UPDATE!

So question was updated a lot, from first version. I will update information what you a looking for. Saving huge encrypted information locally.

Maybe easer way to do it, it's just use local encryption of data, as I described above, using Android KeyStore, KeyChain (links above). You will create our own KeyPair and will use for encryption and descryption some data. But this data, you will save in your DB in encrypted view.

Another more complex solution, will be creation of mechansim for encyption/decryption DB. As you described, you will save all information in DB, and after, just encrypt/decrypt you DB files. Fortunatly, we already have such library SQLCipher, just take a look. Fore example, this is pretty simple tutorial

Answer 3

Let's say, that you have a generated password along with other details like user name. Storing this kind of data is a perfect fit for SQLite. But, storing in plain text is not safe. Either the whole database or individual records should be encrypted. The former can be done using one of the open source database encryption libraries. For the later you have a couple of options:

1. Ask the user for a password each time he opens the app. Generate the actual encryption key using password-based encryption and the same salt value.

2. You can use the Android Keystore Provider to generate an encryption key and save it for you in a safe location on the device. Later, you retrieve the entry from the keystore and use it to encrypt/decrypt your database records using javax.crypto.Cipher.

Both options ensure that the encryption key is not be present in the app.