Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

I've been told that the SD card is a terrible place to store secure data because any app can read it. How else can my phone store my private key I use to log into my home PC ssh server?

share|improve this question
    
Which app uses the private key? Is your device rooted? –  Robert Dec 21 '11 at 9:10
    
Which version of Android? More recent versions support disk encryption which will prevent certain types of attacks. I would recommend you protect the private key with a strong password in any event. –  nwaltham Dec 21 '11 at 12:35
add comment

2 Answers

up vote 3 down vote accepted

I use ssh in a terminal.

$ ls -l .ssh
-rw-------    1 10106    10106          427 Jan  8 07:39 id_rsa
-rw-rw-rw-    1 10106    10106          319 Jan  8 07:39 id_rsa.pub
...
$ pwd
/data/data/com.magicandroidapps.bettertermpro/home

So the private key is protected simply by the unix filesystem and Android's user-per-app design: only Better Terminal Emulator Pro can read id_rsa, and only ssh and other programs I'm aware of run under it.

Whatever your app is, it need only do this to enjoy the same security from other apps. Full-sdcard encryption, unless it comes packaged with a filesystem having a comparable system of permissions, will not protect your data from other apps.

share|improve this answer
add comment

If your phone is rooted, you have the option of placing the key in a 'protected' area in which any application requesting to access the file would need to be given root access by you.

  • This provides very little protection in the case of an attacker gaining physical access to your phone.

You can also create a key that requires a pass-phrase to be entered in order to unlock and use the key.

  • You should consider spending four or five additional seconds in order to login to your server in order to protect your assets.

As previously mentioned, Android is moving towards full disk encryption, which will substantially increase security of the device in general.

share|improve this answer
    
The latest versions of Android now support full disk encryption. When setting it up, I'd recommend using a pin or passphrase that is not the same as your unlock pin. –  earthmeLon Jun 23 '13 at 22:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.