2

I have an Android app that has a login page. While accessing from the browser, suggestions are shown for username field. This is fine. However, it shows suggestions for password field also. I just would like to know what sort of security issues that might arise.

It shows previously used passwords. There is no password manager feature. Looks like the data is cached as plain text. The field is of type text or password based on a flag. If type is text, password suggestions are shown. Does this look like a software bug or security issue?

  • 2
    Seems more like a misconfigured component inside the XML of the Activity. On Default, if you use the Standard component for password input in Android, it won't suggest you somethings beside that Auto-Login Feature in Android 9 – Serverfrog Feb 6 at 15:35
2

Yes, the application is vulnerable to Side Channel Data Leakage.

Words entered by a user via the keyboard are stored in the Android user dictionary(/data/data/com.android.providers.userdictionary/databases/user_dict.db) for future auto-correction. The user dictionary is available to any app without requiring any permission and this could lead to sensitive data being leaked.

It is recommended that for the sensitive data inputs the XML attribute android:inputType should be set with the constants such as textPassword, textVisiblePassword, etc. in order to prevent the sensitive data caching by the keyboard.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.