Please read before assuming this should go in another forum (like an android forum) - this is a Security question.

Here is the scenario:

Developing an health care based android application that has several "credential" elements that need to be stored and used during the application context. These are not the type of credentials where there is interaction with the user, in fact, all credentials are used silently in the background (user unaware) - so I can't go with the prompt each time method of "not storing credentials".

Android of course has the KeyChain class to rudimentary store credentials, but it is more oriented towards certificates and also involves some interaction to get credentials into (and possibly out of) the KeyChain, plus requires the device to become "passworded" (have a lock password... from what I can tell).

What I am looking for are ideas, advice, input, on how, in general application development, non-interactive credentials can be stored... and more specifically if you have some unique twist on the mobile/Android aspect that would be nice.

I have my ideas, but am looking to expand my mind here, to come up with the best solution I can. I will be writing a white paper on this, and if you are interested would be happy to post a link so anyone may access once I have completed my thoughts.

Thanks for all of the input ahead of time.

closed as too broad by user10211, NULLZ, Xander, Lucas Kauffman, TildalWave Aug 27 '13 at 14:50

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I'm not sure if it would help of not, but there might be some stuff that can be done by services that register themselves as Device Administrators. I'm not sure if they get an independent keystore or not, but it might be someplace to check in to. – AJ Henderson Aug 27 '13 at 14:07
  • I swear I am about to quit this forum... If we can't talk about stuff like this, then why have a forum? Jesus! – Tek Tengu Aug 27 '13 at 17:46
  • while I personally didn't vote to close on this one, it is worth highlighting that this specifically is NOT a forum. It is a Q/A site. It's designed as a place for people to get answers to questions and so questions need to be answerable. In this case, people felt that there couldn't be a concise answer. If you are looking for general discussion, a Q/A site isn't the place. If you are looking for an answer to a specific problem, perhaps you can refine it to a question of how to accomplish a more specific goal and that might be seen as a narrow enough scope. – AJ Henderson Aug 27 '13 at 17:52
  • Oh, one other thought, if you want more of an extended discussion kind of thing, you might try seeing if anyone is interested in talking about it in chat. Open discussion is fine and encouraged there. – AJ Henderson Aug 27 '13 at 17:54
  • a. it is a question i am seeking answers for... and imminent need. b. it is a valid type of question for this forum with specificity (I spoke initially and directly about Android, but opened it to larger ideas to aid/help in the discussion). c. the question is about identifying what may be missed in my search and seeking other possibilities if nothing major has been missed - which there are dozens out here. WTF more should this site be about? Just answering newbie, "I can't find my power plug" questions? – Tek Tengu Aug 27 '13 at 18:47

In my opinion the only possibility currently available is requesting, on launch of the application, the user to create a password. This password will then be used to derive a key from and this will then be used to encrypt the other credentials with AES on the device (which might be retrieved from a remote location). The credentials can then be retrieved by the application and decrypted when it needs to access a function which requires these credentials.

Note that you will need to think about locking the credentials after a certain period of being idle.

Not the answer you're looking for? Browse other questions tagged or ask your own question.