I would like to implement a "Remember Me" time-limited auto-login type feature on a mobile application (on Android). To start the app, the user must type in a username and password. For convenience,
I would like to save the last inputted username and/or password into a file on the phone to avoid having the user re-type it each time.
I looked at this, but it seems to be more browser-oriented..
- How would I go about encrypting the file or password? I can't just use a hard-coded key to encrypt it, can I? I'd have to generate the key somehow. However, if the user exits and restarts - I'm assuming a separate key would be generated - so I have to save the key somehow?
- Should I bother encrypting? (I think I should, however only the user would have access to this file anyway...)
Am I over-complicating these things with surrogate keys and/or public key authentication with ssl/tsl? I mean, Firefox saves my passwords, and surely they are encrypted in some way? I was thinking to encrypt the user/pass in a similar fashion? Is that a bad idea?