Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For developing a mobile app, there is a choice of storing usernames and password data in the device itself, or in a server (user will be authenticated to a server). Other than possibly the user have to manage multiple passwords if he has multiple devices, is there a drawback for the former choice? Also, the app is supposed to connect to internet anyway, so "no internet connection" is not an issue.

share|improve this question
If the server is compromised what consequence would that have? – this.josh Nov 15 '11 at 9:16

You need to clarify your question to get a more helpful response.

Here's the generic answer: storing authentication credentials on a device puts those credentials at risk of offline attack. If a device is responsible for saying it is authenticated, then the somebody may spoof it.

Credential caching is not without merit or precedent. Windows systems perform credential caching for network-disconnected logins.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.