How can I securely store my private key I use for logging into my home PC

Question

I've been told that the SD card is a terrible place to store secure data because any app can read it. How else can my phone store my private key I use to log into my home PC ssh server?

Answer 1

I use ssh in a terminal.

$ ls -l .ssh
-rw-------    1 10106    10106          427 Jan  8 07:39 id_rsa
-rw-rw-rw-    1 10106    10106          319 Jan  8 07:39 id_rsa.pub
...
$ pwd
/data/data/com.magicandroidapps.bettertermpro/home

So the private key is protected simply by the unix filesystem and Android's user-per-app design: only Better Terminal Emulator Pro can read id_rsa, and only ssh and other programs I'm aware of run under it.

Whatever your app is, it need only do this to enjoy the same security from other apps. Full-sdcard encryption, unless it comes packaged with a filesystem having a comparable system of permissions, will not protect your data from other apps.

Answer 2

If your phone is rooted, you have the option of placing the key in a 'protected' area in which any application requesting to access the file would need to be given root access by you.

• This provides very little protection in the case of an attacker gaining physical access to your phone.

You can also create a key that requires a pass-phrase to be entered in order to unlock and use the key.

• You should consider spending four or five additional seconds in order to login to your server in order to protect your assets.

As previously mentioned, Android is moving towards full disk encryption, which will substantially increase security of the device in general.