android - 存储密码

Question

我正在创建一个应用来存储加密数据。

在this问题，OP si 建议以明文形式存储用户的凭据。

但是，如果我想存储使用 SecretKeySpec(用于加密数据的密码)创建的加密密码怎么办？据我了解， key 本身是加密的。

所以我可以存储和检索它。

注意:我不是在问如何存储首选项，只是问我是否了解 SecretKeySpec 的工作原理以及如何序列化和检索加密密码。

编辑:抱歉，我忘记指定它需要与 API 级别 4 兼容。

Answer 1

直接来自 developer website .

Be Smart About Security!

It's important to understand that AccountManager is not an encryption service or a keychain. It stores account credentials just as you pass them, in plain text. On most devices, this isn't a particular concern, because it stores them in a database that is only accessible to root. But on a rooted device, the credentials would be readable by anyone with adb access to the device.

With this in mind, you shouldn't pass the user's actual password to AccountManager.addAccountExplicitly(). Instead, you should store a cryptographically secure token that would be of limited use to an attacker. If your user credentials are protecting something valuable, you should carefully consider doing something similar.

Remember: When it comes to security code, follow the "Mythbusters" rule: don't try this at home! Consult a security professional before implementing any custom account code.

Now that the security disclaimers are out of the way, it's time to get back to work. You've already implemented the meat of your custom account code; what's left is plumbing.