0

I've asked this question before, but got no suitable replies, so here I go again. How does the Android AccountManager which is used to store your Google, Facebook, Twitter, etc... usernames and passwords implement security. For instance, off my phone is rooted, can't a third party app read the account passwords of wherever it stood them. I figure that the account manager must store these passwords somewhere on the device our logging in would not work, especially if the device was offline. Thank you for your explanations.

  • 1
    We cannot look into the sources, but it doesn't necessarily store passwords. A token obtained from the server might be sufficient (and is what's normally used – hence when unautorizing a device, you don't need to change your password as it simply invalidates the token assigned). – Izzy May 30 '16 at 20:16
  • Interesting, I think I understand now. Perhaps you can make that an answer. But why are the sources not available? I thought Android was open source. Thanks. – Jack Maddington May 30 '16 at 20:18
  • Izzy, des the system you describe use OpenID? Thanks. – Jack Maddington May 30 '16 at 20:19
  • So, if I'm offline, account manager will be useless to offline apps? – Jack Maddington May 30 '16 at 20:20
  • 1
    See my answer below (time for comment-cleanup). I don't think it's using OpenID, but I cannot tell for sure. – Izzy May 30 '16 at 20:27
2

We cannot look into the sources of the Google AccountManager: while Android itself is open source, the Google apps are not. But we can make an educated guess:

It's not necessary to store passwords on the device in this case. You once enter your password, it gets confirmed server-side, and you receive an "authentication token" in return. That token is saved on the device, and used by it until it gets invalid (either by expiring or by being revoked) – in which case you will be asked again for your password, and the game starts over. This is why you can simply "revoke access" from devices without having to change your account password.

The token is always specific to the device (same reason – otherwise you couldn't revoke access from one device without affecting any other). I can't say whether the token would be useless to some "root app" aquiring it without your permission (non-root apps would have to ask you for your confirmation when first accessing it), or what they could do with such a token while offline (again, closed-source parts) – maybe someone else is able to shed a light on that.

  • Thank you for your answer. I am really hoping that someone else will be willing to provide some more detail this time around. Interesting to know that the Google apps are not open sourced. – Jack Maddington May 30 '16 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.