0

I would like to create a secure chat application for multiple users on a device. The user have to login to the app before using the chat application.

My thought was to store a private key in SharedPreferences, check if the device is rooted. If this is the case, the app cannot be used. So if there is no root, a private key-value pair stored in SharedPreferences should be secure, right? Then I might store for each user on the device a keypair. I do not want to store the chat messages online.

2
  • If the user forgets password, can chats still be viewed by resetting the password? Is offline login to view chats allowed?
    – defalt
    Aug 21, 2022 at 14:43
  • 1
    Not really an answer, but: if you're relying on root detection as part of your security model, you're hosed. An attacker with root-level control of the device can always spoof or bypass such a check, if necessary by modifying your app's code directly. The only thing root detection is good for is warning the user that their data is at risk from malicious apps with high privileges. You can't protect anything in the app - including the code - from the user. That threat model doesn't make sense. If the users don't trust each other, they shouldn't be sharing a device account (or a device at all).
    – CBHacking
    Jan 18, 2023 at 21:35

1 Answer 1

0

Your approach is way to complex. On Android you can create multiple user accounts. They will be well isolated from each other. No login in the chat app is needed (except an initial login after installing the app).

2
  • Could you explain it a little bit more detailed? I have an application which requires a login to interact with the app. There should be a chat as an additional function. Aug 21, 2022 at 15:00
  • 1) You don't need to care how many users use this app on the same device, because they are isolated. Means, setting of your app used for one user are not visible for other users. 2) If you don't use the same key for many apps, you don't have to use shared preferences. 3) If you want, you can cache authentication token e.g. for some days or weeks, before refreshing it. Since user data are isolated, other users will not be able to access it. Caching of auth. token can allow the user to avoid login each time and thus improve user experience. 4) Use Android Keystore to store passwords.
    – mentallurg
    Aug 21, 2022 at 19:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .