Can an android app steal a stored password from any other app I have installed?
Say I have snapchat and I only log in once and stay logged in, if I later delete the cache from that app it will log me out.
Are the stored passwords vulnerable?
-
Are you allowing the possibility that the android device could be rooted? If so, anything on the device should be considered vulnerable. See my answer below.– auspicious99Commented Apr 18, 2020 at 13:35
Add a comment
|
2 Answers
Welcome Alfredo :)
TL;DR
No. Android apps are "sand-boxed" inside their own user in the operation system. So unless Snapchat/you Android version have a specific vulnerability (and if you update your phone this shouldn't happen), other apps are not able to get stored passwords.
Application Sandbox in Android
Android is based on the Linux operation system. Thus, it isolates apps from each other and protects apps and the system from malicious apps. To do this, Android assigns a unique user ID to each Android application, which means all the application files, unless defined otherwise, are protected and accessible only to this specific application (user id).
Other mechanisms for saving users passwords
Android also implemented an account manager, in order for apps to save tokens and passwords securely. In short - that's an encrypted DB that is managed by the operation system itself, and every app could save tokens/passwords using it, in a secure manner.
-
The only exception would be if the app saved the data on the SDcard for some reason. Commented Apr 18, 2020 at 19:01
It depends on what you mean by storing the password. It may be done by each app persisting the data in SharedPreferences, or in something like a sqlite database, or file-based storage. Or, perhaps you're referring to the the android keystore provided by the system.
In the first case (SharedPreferences, sqlite, etc.): By design, each app is supposed to be in its own sandbox. Other apps should not have access to their data. The protection is based on linux permissions. However, there are vulnerabilities, so SELinux has been used in recent years, and the permissions are getting stricter and stricter with each version of android, e.g., what system data that ordinary apps can access is more and more restricted.
In the second case, it could be considered more secure, managed by the android system.
However, it is very common to find android devices that are rooted. The process of rooting removes many of the protections, so android keystore and other app data should all not be considered as safely stored. Some apps like bank apps, or games like Pokemon Go, implement root detection features to prevent the app from running on rooted devices.