For developing a mobile app, there is a choice of storing usernames and password data in the device itself, or in a server (user will be authenticated to a server). Other than possibly the user have to manage multiple passwords if he has multiple devices, is there a drawback for the former choice? Also, the app is supposed to connect to internet anyway, so "no internet connection" is not an issue.

  • If the server is compromised what consequence would that have? – this.josh Nov 15 '11 at 9:16

You need to clarify your question to get a more helpful response.

Here's the generic answer: storing authentication credentials on a device puts those credentials at risk of offline attack. If a device is responsible for saying it is authenticated, then the somebody may spoof it.

Credential caching is not without merit or precedent. Windows systems perform credential caching for network-disconnected logins.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.