Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

My phone is currently inoperative. Samsung asked me to drop it at an approved repair center, which will handle shipment and reception to/from Samsung.

Being unable to boot my phone, it was impossible for me to remove personal files from it.

I am aware all my files will be accessible to anyone handling my phone, once repaired. But what about my passwords ? I know it's possible to get saved WiFi passwords with root access. Is it possible too for passwords from applications ? (Gmail, Dropbox, Website passwords from Chrome, ...)

Bottom line: How safe are my data/passwords on an unencrypted device ?

share|improve this question
3  
Possibly relevant to you: How is the Gmail password stored in Android - and where? –  eldarerathis Nov 27 '12 at 15:57
    
Useful link, thanks ! –  Pierre Espenan Nov 27 '12 at 16:14
    
Do you store website passwords in Chrome? Or, you're talking about logged in session of websites? –  Sachin Shekhar Nov 27 '12 at 16:29
    
I do talk about stored website passwords. (I guess logged in session will be expired by the time Samsung will repair my device, isn't it?) –  Pierre Espenan Nov 27 '12 at 16:35
2  
Some websites and services, such as Gmail, have an option to "logout from all other devices" which enables you to end the session stored in your mobile and any other devices you logged in previously. Just login to the service from any pc/device and find that option (if available). I'm not sure if it works with Google account integration into Android devices. –  yrajabi Nov 27 '12 at 18:15

2 Answers 2

up vote 3 down vote accepted

General information

As The Andro Nerd pointed out in his answer, most apps store passwords (and other sensitive information) encrypted. Some even don't store them at all (they use a kind of "tokens", as is available with most Google apps -- or they don't store anything like that).

Unfortunately, only most apps seem to care this way. Some store everything plain text (the stock email app on some HTC devices is known for that, for example: Storing passwords and even directory information plain text for Exchange services. Sources for this allegation can be found in the book mentioned below).

Which apps are safe?

It's hard to really know which apps are save, though some services help you figure it out -- see e.g. ViaForensic's AppWatchdog, where they thoroughly investigate apps for things like that (but with limited ressources are far from covering everything). Some security blogs inform about found issues as well -- and if some well-known app is affected by such a security hole (as e.g. mentioned email app, or Skype), all the blogs in the world will spread word.

How to check it on your own

Knowing the structures how data are saved, you could investigate yourself (if your device is rooted, that is). Andrew Hoog's book Android Forensics and Mobile Security is one good source teaching you how to do that:

Apps store their data below the /data/data, in a directory with the apps package name as name (for skype, this would be /data/data/com.skype.merlin_mecha/). By default, that directory is accessible by the app alone (and, of course, by root) -- which is why it requires root privileges to dig deeper. The basic structure below is as follows:

/data/data/com.example.demoapp
├── cache                Directory
│   └── webviewCache     Directory
│       ├── 027e59a0     Cache file
│       └── 057606c4     Cache file
├── databases            Directory
│   └── example.db       SQLite database
├── lib                  Directory
└── shared_prefs         Directory
    └── example.xml      Config file

Obviously, there are two major places to check:

  1. the shared_prefs directory, containing XML files. As those are plain-text, they should be easy to investigate.
  2. the databases directory. Database files are usually in the SQLite standard, so you can investigate them with either an SQLite command line client, or with a graphical frontend like SQLiteMan.

A thorough information on this topic would go too far here -- but you got the idea, I hope.

Conclusion

I wouldn't be that much concerned with Samsungs official service (though "bad guys" could sit everywhere -- but one should not go paranoid about it. But of course it is a generally good idea to be careful of which apps one uses. Too late for your current case, might be -- but there's always a tomorrow.

share|improve this answer
    
Nice one, thanks :) Actually, I'm not so worried about Samsung service, but a bit more about the "approved repair center" which is an independent small company. Btw, Cerberus is installed on my device and I am hesitant to send a "Wipe memory" command on it. I guess Samsung will at some point connect it to the Internet. The command would be executed at this time, so at the end the intermediate company would get a wiped device ; but I am afraid of the reaction of the guy at Samsung handling the phone... What do you think ? –  Pierre Espenan Nov 27 '12 at 21:24
    
Valid point -- at least if you consider your data lost either way. In that case, I'd do it. Not because I'd feel paranoid -- but if I had an easy option and wouldn't use it, and then something would go wrong, I'd blame myself for stupidity ;) –  Izzy Nov 27 '12 at 21:38
    
Knowing that the guy at the repair center told me it was likely due to a motherboard fault. If it's true : 1/ the motherboard will be changed, and the old one destroyed (the memory is sealed on it, right?) 2/ it will be repaired, and if the memory remains intact, Cerberus will be able to wipe during it tests process 3/ I get a all new phone and the old one will be securely wiped (I hope) by Samsung for refurbish –  Pierre Espenan Nov 27 '12 at 21:40
    
Nope I don't care about getting my data back, I already have backups. I just don't want someone else to access it. So you think I should try to remotely wipe it? I'm just scared of Samsung's reaction. (Concerning warranty, more exactly. Cerberus is an app which needs root access, and my device has been flashed many times. I may be on the edge of a broken warranty. Even though European law says I'm not, I don't know what Samsung intergalactic law says ;)) –  Pierre Espenan Nov 27 '12 at 21:45
    
So what's the difference (in terms of warranty)? If they look at it, they'll see it was rooted either way. And if you are living inside the EU, EU law should count -- regardless where they repair the device. It's your right to protect your data. –  Izzy Nov 27 '12 at 21:57

Most (if not all) applications will store saved passwords in an encrypted format in their database in their data folder.

As such, your passwords will be safe - they would have to access the database, and then decrypt the stored the encrypted password.

As well as that, they will most likely wipe your device anyway (not always done, depends on the repair).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.