We have a use case wherein a mobile app that can be used by multiple users on the same device needs to authenticate the users in some offline scenarios. We were using Password grant as in OAuth2 to check the password when the user is online and storing the password's PBKDF2 hash in the device. I know this is less secure, is there any better alternative?


1 Answer 1


I would use something more modern than PBKDF2 (unless required for compliance reasons), and would put an expiration on the local password hashes and local user data (refreshed every time the user successfully authenticates via the server). Also make sure that, if the user tries to log in using the server and fails (as might happen if the user was deleted/disabled or their password changed), their password hash (and any locally-cached data, as I assume you must have) is deleted so that they can't go offline and log in again.

The critical place this breaks down, of course, is if some user (or other app on the device) has root access, or at least enough privileges to poke into your app's local storage. Then they could change the password hashes (gaining the ability to log in offline as anybody), and read or modify the user data stored in the app (even if it was stored for a user whose actual password they don't know).

Thus, you should consider encrypting each user's local data cache with a key specific to the user (probably derived from their password, ideally using a different hashing process and/or salt than the one used to authenticate the user). Don't actually store the encryption key at all; force it to be re-derived each time. That way, user Alice can't access user Bob's data on the device, even if Alice has root access and can reset Bob's password hash.

  • Is there any api in Android or iOS where we can store sensitive information like passwords instead of local storage? Feb 28, 2021 at 1:58
  • 1
    For storing credentials (or security tokens) on iOS, yes: Keychain (same as on MacOS). On Android... not built in. There's credential storage, but that's meant to facilitate automatic login, not to store secrets the app will compare against other stuff. There's what Android calls KeyChain, but it's only for private asymmetric keys. However, there are libraries that use KeyChain to store the decryption key for arbitrary secrets. Bear in mind, though: none of this is secure against the user in the case of a rooted phone.
    – CBHacking
    Feb 28, 2021 at 6:01
  • I found an approach which is specified in this blog - anadea.info/blog/… Do you see any problems with that? Mar 1, 2021 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.