2

I am testing an Android application I am creating for learning purposes (I am using a pre-existing skeleton code my friend gave me). The application uses firebase and stores the JWT token in an xml file in shared_prefs. I am testing this app on a rooted device, so it occurs to me a malicious app could gain access to this folder (/data/data//shared_prefs) and therefore the JWT token stored in the XML file. Is this considered best practice? Where should I store the JWT token? Should it not be stored in shared_prefs at all?

Should I use some sort of key to encrypt these files so they can't just be pulled by a malicious app?

Improve this question

2 Answers 2

Reset to default
1

This is fine and is about as good as you can get on Android. Unlike iOS, there is no secret storage mechanism (Keychain) and instead devs are to rely on sandboxing to protect secrets. The /data/data/<app> directory when stored on internal storage is protected from other applications reading it through sandbox restrictions. If this data is written to the app's external storage folder (which SharedPreferences does not do), other apps can freely read the secrets. Since that isn't happening here though, the secret is safe.

See https://developer.android.com/training/articles/security-tips for more info.

Improve this answer
0

Sounds a bit like you're confusing having a rooted phone and your app having root access, those are different things. If you running a vulnerable android application on a rooted device which has access of root privilledge and you think you can read data of other application this is probably not gonna happen.

SharedPreferences are data that can be stored by an application’s directory on the phone that can allow access. MODE_PRIVATE (0) which is file creation mode and the default mode, where the created file can only be accessed by the calling application (or all applications sharing the same user ID).

You can assign the used id to both application via android:sharedUserId in your xml file and getting context of the package and passing shared preference name which you need to know along with the data key.

You can see everyone assign unique key and flag hence literally no one in the world would want to expose there app , as they don't want their shared preferences to be read by others. Everyone uses the MODE_PRIVATE constant, so they can't be read by others.

So can you modified access without user interaction? That is absolutely not possible, not even with root. When you request root access, the user gets prompted to accept or decline that your app should get root access, that dialog can't be circumvented by any means.

One more thing why would anyone log into other devices. Android has tough security beacause of sandboxing but as you might know nothing is secure in this world. The SharedPreferences implementation in Android is thread-safe but not process-safe yet, and so you will get disk-read violations from StrictMode for the reading

There were flags used in older API where the some constant has been used. Unfortunately the docs now don't even explain MODE_WORLD_READABLE and MODE_WORLD_WRITEABLE, instead saying that constant was depreciated in API level 17

So you cannot access it via code but with file system. you should note that SharedPreferences are stored as XML files in the /data/data/ directory, which essentially means that any application with superuser privileges on a rooted device can access your SharedPreferences, even if they were created with MODE_PRIV. If someone was able to mount your device's filesystem without using the installed Android OS, they could also bypass the permissions that restrict access.

At last If you're concerned about such access to your preferences then you need to encrypt it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .