When building a mobile app, it is expected (OWASP etc) that any sensitive data that the app stores be properly encrypted. That would include for example any passwords, session cookies, OAuth tokens.
On Android the apps normally use SharedPreferences to store such data. These can only be read by the app itself, unless someone has root access to the phone, in which case he/she can read the SharedPreferences of all apps.
Although I fully agree to the encryption of such data, it is not quite clear to me which threat are we mitigating by doing so, because:
- On a non-rooted phone, only the app itself can read the data, encrypted or not.
- On a rooted phone all bets are off, since root can brute-force the master keys and then extract the app-keys to decrypt the data.
One point I see is that if the whole content of the phone were to be backed-up to an external service/filesystem, then the OS-protections would not apply anymore, so anyone with access to the backup could read all files. Is there any other threat we are mitigating by using encryption?