Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Please read before assuming this should go in another forum (like an android forum) - this is a Security question.

Here is the scenario:

Developing an health care based android application that has several "credential" elements that need to be stored and used during the application context. These are not the type of credentials where there is interaction with the user, in fact, all credentials are used silently in the background (user unaware) - so I can't go with the prompt each time method of "not storing credentials".

Android of course has the KeyChain class to rudimentary store credentials, but it is more oriented towards certificates and also involves some interaction to get credentials into (and possibly out of) the KeyChain, plus requires the device to become "passworded" (have a lock password... from what I can tell).

What I am looking for are ideas, advice, input, on how, in general application development, non-interactive credentials can be stored... and more specifically if you have some unique twist on the mobile/Android aspect that would be nice.

I have my ideas, but am looking to expand my mind here, to come up with the best solution I can. I will be writing a white paper on this, and if you are interested would be happy to post a link so anyone may access once I have completed my thoughts.

Thanks for all of the input ahead of time.

share|improve this question

closed as too broad by Terry Chia, NULLZ, Xander, Lucas Kauffman, TildalWave Aug 27 '13 at 14:50

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

I'm not sure if it would help of not, but there might be some stuff that can be done by services that register themselves as Device Administrators. I'm not sure if they get an independent keystore or not, but it might be someplace to check in to. – AJ Henderson Aug 27 '13 at 14:07
I swear I am about to quit this forum... If we can't talk about stuff like this, then why have a forum? Jesus! – Tek Tengu Aug 27 '13 at 17:46
while I personally didn't vote to close on this one, it is worth highlighting that this specifically is NOT a forum. It is a Q/A site. It's designed as a place for people to get answers to questions and so questions need to be answerable. In this case, people felt that there couldn't be a concise answer. If you are looking for general discussion, a Q/A site isn't the place. If you are looking for an answer to a specific problem, perhaps you can refine it to a question of how to accomplish a more specific goal and that might be seen as a narrow enough scope. – AJ Henderson Aug 27 '13 at 17:52
Oh, one other thought, if you want more of an extended discussion kind of thing, you might try seeing if anyone is interested in talking about it in chat. Open discussion is fine and encouraged there. – AJ Henderson Aug 27 '13 at 17:54
a. it is a question i am seeking answers for... and imminent need. b. it is a valid type of question for this forum with specificity (I spoke initially and directly about Android, but opened it to larger ideas to aid/help in the discussion). c. the question is about identifying what may be missed in my search and seeking other possibilities if nothing major has been missed - which there are dozens out here. WTF more should this site be about? Just answering newbie, "I can't find my power plug" questions? – Tek Tengu Aug 27 '13 at 18:47

In my opinion the only possibility currently available is requesting, on launch of the application, the user to create a password. This password will then be used to derive a key from and this will then be used to encrypt the other credentials with AES on the device (which might be retrieved from a remote location). The credentials can then be retrieved by the application and decrypted when it needs to access a function which requires these credentials.

Note that you will need to think about locking the credentials after a certain period of being idle.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.