Is there an equivalent to iOS's Keychain for user credentials on Android?

Question

Is there an equivalent to iOS's Keychain on Android?

My understanding of the Preferences API is that it is not encrypted. For my application it doesn't matter whether these credentials are persisted across devices (i.e. a different use-case to iPhone-like Keychain in Android?)

I also looked at the KeyStore API but it seems to leave the actual storage of user credentials up to the application developer.

nmr · Answer 1 · 2016-07-05T19:17:50.597

10

Short answer, there isn't one. But you can expect the filesystem to be secure.

Each app operates under a different user, and the filesystem used to store app data is secured by normal UNIX user permissions. So each app's file access is sandboxed by default. The filesystem also may be encrypted.

This page from the developer's site explains it better: http://developer.android.com/guide/topics/security/security.html

edited Jul 05 '16 at 19:17

answered Mar 16 '11 at 16:13

nmr

16,625
10
53
67

19

When you lock an iOS device with a password or pin code, those are used as part of the private key. The 6-minute hack is only applicable to unlocked devices. – Heath Borders Feb 02 '12 at 05:09
4

what happens when the user changes the iOS passcode? it de/re-encrypts the keychain? – Jeffrey Blattman Oct 10 '12 at 16:43
7

Every iOS runs in its own sanbox too. So the UNIX user separation is no excuse. Permissions separation is no alternative for an encrypted store! – miho Jan 27 '14 at 09:12
2

How do you persist the key on Android even when the user uninstalls and reinstalls the app? – Super Engineer Dec 23 '15 at 09:54
there is one, see the answer about SmartLock below (which is the correct answer). – Guillaume Laurent Jun 16 '19 at 08:38

score 6 · Answer 2 · answered Jun 28 '17 at 11:01

6

Actually there is:

By integrating Smart Lock for Passwords into your Android app, you can automatically sign users in to your app using the credentials they have saved. Users can save both username-password credentials and federated identity provider credentials.

Integrate Smart Lock for Passwords into your app by using the Credentials API to retrieve saved credentials on sign-in. Use successfully retrieved credentials to sign the user in, or use the Credentials API to rapidly on-board new users by partially completing your app's sign in or sign up form. Prompt users after sign-in or sign-up to store their credentials for future automatic authentication.

https://developers.google.com/identity/smartlock-passwords/android/

answered Jun 28 '17 at 11:01

neteinstein

17,529
11
93
123

3

This API does not really facilitate storing arbitrary OAuth tokens etc. It seems to more provide a way for the user to sign into your app. For apps which are providing secured access to other services, its not useful. Doesn't really answer the original question – yano Jul 03 '17 at 18:17
You can look at it from a different perspective. If you can only store user and password why don't you persist that only and maintain the token in memory only. Whenever the app restarts it re-authenticates. Not brilliant, but currently seems the safest way. – neteinstein Nov 15 '17 at 16:10
1

I will repeat that "this is not equivalent or appropriate approach" for such task. Smart Lock is equivalent of "Save Credentials/Password" in Browser. You can use "username/password" saved in browser in mobile apps and vice versa. Also This library requires Google Play Services, which is not feasible for all devices. – Jemshit Feb 18 '21 at 09:45
this is totally wrong and different, I'm afraid – Fattie Jun 27 '22 at 14:26

score 4 · Answer 3 · answered Oct 12 '15 at 08:34

Expanding upon @DJPlayer's answer:

Some relevant articles. The third includes a github app that demonstrates using the keystore provider to generate keys and then encrypt strings.

Also see Android Storage Options for ways to store the encrypted password - my recommendation is Shared Preferences.

Note that according to the second article with root access and a bit of knowledge of how your app uses the keystore (which might be obtainable from decompiling your apk), it's possible to hijack the private key and use it to decrypt encrypted material (ex: the persisted password)

For the third article, once the keys are generated and then used to encrypt plaintext, where are the encrypted strings then stored? — Android Noob, Dec 24 '15 at 16:12

score -3 · Answer 4 · answered Oct 19 '11 at 15:04

-3

http://developer.android.com/reference/android/security/KeyChain.html

Keychain for OS 4.0

answered Oct 19 '11 at 15:04

DJPlayer

3,244
2
33
40

43

... which appears to only store keys and certs, and **not** user credentials, which is what the questioner is interested in. – Sixten Otto Dec 06 '11 at 17:06
3

@SixtenOtto you can store user credentials encrypted with some key, and store that key in keychain. There is, of course, more work to be done but it's doable. – Dmitry Zaytsev Apr 01 '14 at 08:37
@DmitryZaytsev your suggestion from 2014 is implemented in Jetpack Security lib now :D – Jemshit Feb 18 '21 at 09:47
2

@JemshitIskenderov haha, nice. It only took 6 years :D – Dmitry Zaytsev Feb 21 '21 at 10:21

Is there an equivalent to iOS's Keychain for user credentials on Android?

4 Answers4

Linked

Related