1

Under what circumstances will a current Android sync or otherwise send passwords off the device? The credentials in question are for:

  • WiFI
  • Non-Gmail email accounts accessed through the stock Gmail app
  • Other apps, eg. Twitter

This question is on behalf of a family member looking at acquiring a Pixel 3, but concerned over how such is handled (including whether apps are able to read each other's data). I've been able to find details of how the Gmail app works with credentials for Gmail accounts, but for other email types and the other cases the details seem more fuzzy (or the answers more than five years old).

It is of course expected that for email protocols such as POP3 the client will need to submit the credentials off the device to authenticate with the service; this question is about whether they might get sent somewhere else as well, for whatever reason, and whether this can be controlled.

1

The Wifi credentials are automatically synced to the Google Cloud if you have enabled the setting "Backup to Google Drive" (Android settings).

Regarding the credentials (e.g. username and password) used by other apps there is no way to say something in general. Those apps may or may not store the required credentials in a secure way. Modern Android systems (Android 5 and newer) provide some relative secure mechanisms for using encryption keys that are maintained by Android itself. Those keys can then be used for encrypting the credentials before saving them to the flash memory. But using encryption the correct and secure way isn't easy. A lot of app developers use the easy and sloppy way and store credentials more or less in plain text.

Also the automatic backup into the cloud comes into play - if the app developer has not configured it correctly the stored credentials are backuped/synced into the Google cloud (if enabled system-wide, see first section).

Last but not least the is your question about the possibility to detect if an app sends credentials into the net. Unfortunately the only answer is: If the app developer wants to do so the app can do it. Additionally this can also be done by any development library the developer includes into the app (advertising, tracking, ...).

  • Just for a specific clarification, is it understood how the official Gmail app itself handles POP credentials? The way I'm reading this answer implies backup of Android settings acts as a sort of master switch for such cloud syncing for all apps (short of them having their own mechanisms). – Lofteyn Apr 15 at 10:04
  • There is the system wide "Google cloud master switch", furthermore every app can disable backup completely for it's data or it can specify which files are included or excluded from backup (all app specific settings are defined by the app developer and can't be changed by the Android user). Where the POP credentials are stored by GMail and if or if not they are excluded from backup is unknown to me. – Robert Apr 15 at 10:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.