5

Since I needed root permissions for several apps on my Samsung Galaxy S8+ (SM-G955F) device, I followed a guide that showed how to install a superuser binary on the device's Android 7.

There was a caveat: such procedure requires encryption to be disabled for the device to be bootable; Samsung devices will in fact refuse to decrypt their storage upon startup if they detect a modified boot partition. So I just went on with it and removed encryption features from my device.

Now, what I wonder is: since I have several apps (e.g. KeePassDroid, Solid Explorer, Google Play Store) that can ease user authentication by storing passwords in such a way that they can be accessed by simply scanning a fingerprint on the sensor, will the fact that my device's main storage is decrypted mean that the saved copies of the passwords can be read in plaintext by anyone who can access the root filesystem of my device?

For instance, say I lose my phone, someone stumbles upon it, connects it to their machine and boots TWRP recovery, which gives them root access to the Android file system. Is there a directory in which they find clear or easily-decryptable passwords secured via fingerprint authentication? Or is there some other, maybe hardware-based, encryption system?

  • I don't believe Google Play Store stores your password and uses it when you authenticate using your fingerprint. It lets Fingerprints be one mode of authentications – Limit Apr 10 '18 at 22:08
  • I'm sure that KeePassDroid encrypts passwords. – Neil Smithline Apr 11 '18 at 2:25
  • @Limit You are most likely correct, however there has to be some sort of encrypted "token" or anything of that sort for authentication, I don't want to believe there is a plaintext file on my device that is able to unlock my Google account as it is. – Manchineel Apr 11 '18 at 7:38
1

We can't answer this for all possible cases(you can't account for human stupidity) but I will try to give a relevant answer.

Now, what I wonder is: since I have several apps (e.g. KeePassDroid, Solid Explorer, Google Play Store) that can ease user authentication by storing passwords in such a way that they can be accessed by simply scanning a fingerprint on the sensor, will the fact that my device's main storage is decrypted mean that the saved copies of the passwords can be read in plaintext by anyone who can access the root filesystem of my device?

I believe that developers of trusted, reputed security software would not depend on the device being encrypted to protect their data. If that were the case, then any privileged file explorer software would be able to show your files in plaintext.

For instance, say I lose my phone, someone stumbles upon it, connects it to their machine and boots TWRP recovery, which gives them root access to the Android file system. Is there a directory in which they find clear or easily-decryptable passwords secured via fingerprint authentication? Or is there some other, maybe hardware-based, encryption system?

Like in the previous paragraph, if you use trusted and reputed software, you should not have to worry about this. Fingerprint authentication is just a mode of authentication and should not have anything to do with how you encrypt your app's data. Same goes for device encryption. Ideally it would not make a difference to app developers.

  • For instance, KeePassDroid hosts a password database which is strongly encrypted in the .kdbx file format. When I open it normally, it asks me for the password (because even itself does not know it). When you enable fingerprint authentication, it asks you for the password once, then you can unlock it via fingerprint. What I assume it does is encrypt the password with some other key and store it. Now, the point is, where does that key the password was encrypted with come from? Is it sent by the fingerprint sensor upon successful scan? Or is the whole key stored on another chip? – Manchineel Apr 11 '18 at 20:02
  • Or maybe is the system relying on none having access to the files of the device outside the safe /data/media directory – Manchineel Apr 11 '18 at 20:03
  • Some software can potentially rely on file system ACL to protect their data. – Limit Apr 11 '18 at 21:25
  • 1
    @alex2003super As for your first comment, no fingerprint sensor is just used to check if you are indeed who you claim to be (developer.android.com/about/versions/marshmallow/…) . It does not send any passwords to you. My guess is that Keepass integrates Fingerprint API with Android key store to keep the keys protected and use them when authentication succeeds – Limit Apr 11 '18 at 21:31
  • 1
    Oh wow, so those keys are actually bound to the security hardware of the device. This makes sense. Thank you very much – Manchineel Apr 12 '18 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.