I've been trying (and failing) to find where the Xfinity Authenticator app stores the TOTP secret. Nothing in any files in shared_prefs looks like a TOTP key, and I'm beginning to suspect that it's being stored elsewhere. In particular, the com.comcast.xfinityauthenticator_preferences.xml file has the following value in it:

<boolean name="keyCredentialStoredInVault" value="true" />

Any guidance on where to go from here would be appreciated.

  • Could probably in Databases, no backup, or files directory. Check them too. – Firelord Jul 9 '19 at 2:07
  • Yes, I should have clarified that I've been through all of the files inside /data/data/com.comcast.xfinityauthenticator/ and none of the strings that look like likely keys produce codes that match the output of the app. – geostar1024 Jul 9 '19 at 2:47
  • Isn't there a place in the device's secure storage (can remember the name currently – keystore?)? I'm using andOTP and it offers that. And I've no idea how to extract stuff from there. – Izzy Jul 9 '19 at 6:35
  • @Izzy The Android keystore? – Death Mask Salesman Jul 9 '19 at 7:37
  • 1
    @DeathMaskSalesman Yepp, that one – thanks for linking! – Izzy Jul 9 '19 at 18:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.