5

When building a mobile app, it is expected (OWASP etc) that any sensitive data that the app stores be properly encrypted. That would include for example any passwords, session cookies, OAuth tokens.

On Android the apps normally use SharedPreferences to store such data. These can only be read by the app itself, unless someone has root access to the phone, in which case he/she can read the SharedPreferences of all apps.

Although I fully agree to the encryption of such data, it is not quite clear to me which threat are we mitigating by doing so, because:

  • On a non-rooted phone, only the app itself can read the data, encrypted or not.
  • On a rooted phone all bets are off, since root can brute-force the master keys and then extract the app-keys to decrypt the data.

One point I see is that if the whole content of the phone were to be backed-up to an external service/filesystem, then the OS-protections would not apply anymore, so anyone with access to the backup could read all files. Is there any other threat we are mitigating by using encryption?

Improve this question
1
  • 1
    "since root can brute-force the master keys" -- then they were poorly encrypted.
    – CommonsWare
    Commented Dec 19, 2016 at 12:44

3 Answers 3

Reset to default
4

Answer is partially in your question:

On a non-rooted phone, only the app itself can read the data, encrypted or not.

This is an assumption of phone's OS providing security guarantees properly. Practical evidence shows that frequently it's not the case, so that's precisely why it's recommended to encrypt sensitive data: if normal access control fails.

So people come up with two countermeasures: - encrypting everything with external secret (user's password) - encrypting everything with a secret, which is stored in secure compartmented storage (trustzone / secure enclave).

Even the latter is not good enough (when OS-side implementation is bad, trustzone is subject to attacks, see https://www.blackhat.com/docs/us-15/materials/us-15-Shen-Attacking-Your-Trusted-Core-Exploiting-Trustzone-On-Android-wp.pdf).

On a rooted phone all bets are off, since root can brute-force the master keys and then extract the app-keys to decrypt the data.

The goal for good encryption is to make brute-forcing pointless in the first place.

Improve this answer
4

This is about defence in depth.

Whilst only the correct app should be the only one with access on a non-rooted phone, there are many examples indeed (especially on Android) of applications capable of breaking out of the standard security model.

Improve this answer
1
  • Exactly, it's the same reason why you would encrypt sensitive data on a database server. When for some reason your server is compromised and the data is leaked, all the attacker gets is the encrypted information and not the clear-text data. Basically the same applies when someone steals your phone.
    – knipp
    Commented Dec 19, 2016 at 14:45
0

Many apps, including chat apps, do not encrypt the contents of their sensitive files, for the exact reasons you mention. When you make a backup to local storage for example the sdcard, or to a remote location you should encrypt the files.

Improve this answer
1
  • 3
    Not sure this actually answers the question? Unless you mean to say that there is no benefit, but then I think you should do so explicitly.
    – Anders
    Commented Dec 19, 2016 at 11:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .