6

Since I needed root permissions for several apps on my Samsung Galaxy S8+ (SM-G955F) device, I followed a guide that showed how to install a superuser binary on the device's Android 7.

There was a caveat: such procedure requires encryption to be disabled for the device to be bootable; Samsung devices will in fact refuse to decrypt their storage upon startup if they detect a modified boot partition. So I just went on with it and removed encryption features from my device.

Now, what I wonder is: since I have several apps (e.g. KeePassDroid, Solid Explorer, Google Play Store) that can ease user authentication by storing passwords in such a way that they can be accessed by simply scanning a fingerprint on the sensor, will the fact that my device's main storage is decrypted mean that the saved copies of the passwords can be read in plaintext by anyone who can access the root filesystem of my device?

For instance, say I lose my phone, someone stumbles upon it, connects it to their machine and boots TWRP recovery, which gives them root access to the Android file system. Is there a directory in which they find clear or easily-decryptable passwords secured via fingerprint authentication? Or is there some other, maybe hardware-based, encryption system?

3
  • I don't believe Google Play Store stores your password and uses it when you authenticate using your fingerprint. It lets Fingerprints be one mode of authentications
    – Limit
    Apr 10, 2018 at 22:08
  • I'm sure that KeePassDroid encrypts passwords. Apr 11, 2018 at 2:25
  • @Limit You are most likely correct, however there has to be some sort of encrypted "token" or anything of that sort for authentication, I don't want to believe there is a plaintext file on my device that is able to unlock my Google account as it is.
    – Manchineel
    Apr 11, 2018 at 7:38

2 Answers 2

1

We can't answer this for all possible cases(you can't account for human stupidity) but I will try to give a relevant answer.

Now, what I wonder is: since I have several apps (e.g. KeePassDroid, Solid Explorer, Google Play Store) that can ease user authentication by storing passwords in such a way that they can be accessed by simply scanning a fingerprint on the sensor, will the fact that my device's main storage is decrypted mean that the saved copies of the passwords can be read in plaintext by anyone who can access the root filesystem of my device?

I believe that developers of trusted, reputed security software would not depend on the device being encrypted to protect their data. If that were the case, then any privileged file explorer software would be able to show your files in plaintext.

For instance, say I lose my phone, someone stumbles upon it, connects it to their machine and boots TWRP recovery, which gives them root access to the Android file system. Is there a directory in which they find clear or easily-decryptable passwords secured via fingerprint authentication? Or is there some other, maybe hardware-based, encryption system?

Like in the previous paragraph, if you use trusted and reputed software, you should not have to worry about this. Fingerprint authentication is just a mode of authentication and should not have anything to do with how you encrypt your app's data. Same goes for device encryption. Ideally it would not make a difference to app developers.

7
  • For instance, KeePassDroid hosts a password database which is strongly encrypted in the .kdbx file format. When I open it normally, it asks me for the password (because even itself does not know it). When you enable fingerprint authentication, it asks you for the password once, then you can unlock it via fingerprint. What I assume it does is encrypt the password with some other key and store it. Now, the point is, where does that key the password was encrypted with come from? Is it sent by the fingerprint sensor upon successful scan? Or is the whole key stored on another chip?
    – Manchineel
    Apr 11, 2018 at 20:02
  • Or maybe is the system relying on none having access to the files of the device outside the safe /data/media directory
    – Manchineel
    Apr 11, 2018 at 20:03
  • Some software can potentially rely on file system ACL to protect their data.
    – Limit
    Apr 11, 2018 at 21:25
  • 1
    @alex2003super As for your first comment, no fingerprint sensor is just used to check if you are indeed who you claim to be (developer.android.com/about/versions/marshmallow/…) . It does not send any passwords to you. My guess is that Keepass integrates Fingerprint API with Android key store to keep the keys protected and use them when authentication succeeds
    – Limit
    Apr 11, 2018 at 21:31
  • 1
    Oh wow, so those keys are actually bound to the security hardware of the device. This makes sense. Thank you very much
    – Manchineel
    Apr 12, 2018 at 12:09
0

To put more detailed insight on that:

Safety of the (possibly) encrypted passwords stored on the device has nothing to do with encrypting the Android device itself. If these passwords(and I suppose that it how it was implemented) are encrypted by the application itself so the file with password is encrypted no matter the state of the device's itself storage encryption.

Keys will be stored in the Android Keystore, which on modern devices need to be implemented using either TEE(Trusted Execution Environment) or SE(Secure Element) which are separated, secure area of main processor or dedicated hardware module(depends on the device and Android system version) More on that in this great article.

This is the first part of it, the second one is that the key used for encrypting your password is bound to the biometric authentication itself. When creating a key there is an option to make it usable only when authorized by user(in this case by fingerprint). Key can only be used when user will successfully confirm its usage by his/her fingerprint. More on that you can read in this excellent blogpost

So even if someone will gain access to your device(which has filesystem encryption disabled) with password encrypted somewhere on it, won't be able to decrypt it without authorizing it with biometrics.

There is also one additional point worth to note, even if someone will add new fingerprint to existing ones with intention to bypass the previously created keys using the new fingerprint, Android will prevent that. If any new fingerprint will be added after some keys were bound with biometrics, all of them will be irreversibly invalidated

Indicates that the key can no longer be used because it has been permanently invalidated. Additionally, keys configured to require user authentication to take place for every of the keys, are also permanently invalidated once a new fingerprint is enrolled or once no more fingerprints are enrolled.

https://developer.android.com/reference/android/security/keystore/KeyPermanentlyInvalidatedException

Of course all I'm saying above is a guess about(the correct) implementation that should be used in case of the applications you mentioned.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .