39

I have looked around and found no information on how Android manages to store passwords on the device. Especially Gmail passwords. I'm looking to learn how Android encrypts and stores passwords ? What key does it use and where is this key stored, and what encryption algorithm it uses.

Improve this question
3
  • 1
    Why should the stored password be encrypted with a key? This would only mean that one has to enter the key every time the password is required, then you could simply not store the password and enter it every time.
    – Flow
    Sep 12, 2012 at 11:52
  • Um, the key could be device specific, obtained from the phone IMEI or something. Which means, the software can get the key without having the user to type it in everytime.
    – asudhak
    Sep 12, 2012 at 13:27
  • 1
    What prevents any other software piece running on the phone to get the key? This approach adds no extra layer of security
    – Flow
    Sep 12, 2012 at 13:48

2 Answers 2

Reset to default
37

Gmail's official app doesn't store password in your device. Your password is 100% safe if you use this app.

This is how it works: The password is used by Google's authentication servers for the first time ONLY. After first successful authentication, an Auth Token is downloaded to device which is stored in accounts.db file as plain text. For all subsequent logins, this Auth Token is used, NOT your original password.
So, if your device is stolen, all anyone can get is Auth Token which becomes invalid once you change your password. So, you'll be in ultimate command.
For ultimate security, I'd recommend you to enable 2-Factor Authentication & create Device Specific Password for your device. After losing device, all you need is to disable that device. You don't even need to change main password.

Note: These all aren't true if you use third-party email apps for Gmail viz. Stock Email app, K-9 Mail etc. IMAP or POP protocol needs original password to authenticate users everytime. So, plain password needs to be available to email app before sending it to server. So, most of email apps store passwords in plain text (hashing/encryption is useless because hashing/encryption key needs to be stored locally). In this case, I'd recommend you to enable 2-Factor Authentication & create Device Specific Password for your device. After losing device, all you need is to disable that device.

Update:
Technically, its possible to store passwords locally in encrypted/hashed form without keeping encryption key/ hashing key in plain text locally. Thanks to @J.F.Sebastian for pointing it out. Unfortunately, such implementation for Android isn't available yet. Starting ICS, Android provides KeyChain API using which an app can store a password locally in secure form. Apps using KeyChain API are rare, but stock email app uses it (Thanks to @wawa for this info). So, your password will be safe with stock email app as long as your screen is locked. Remember, KeyChain isn't safe if device is rooted and its not available on pre-ICS devices.

Improve this answer
1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Andrew T. ♦
    Jul 28, 2022 at 20:40
12

Android passwords used with the built-in Email application are stored in plain text inside a SQLite Database. This is in contrast to the Gmail application, which uses Auth Tokens as described in Sachin Sekhar's answer.

For Jelly Bean, the database location is:

/data/system/users/0/accounts.db

The above location varies with the Android version

This location on a non-rooted device is secured and protected by the Operating System.
On rooted devices, users have already technically cracked their own security, and even if it wasn't in plain text it would still be trivial to decrypt as the key has to exist somewhere on the device to do it.

A member from the Android Development Team posted an explanation that till today still applies:

Now, with respect to this particular concern. The first thing to clarify is that the Email app supports four protocols - POP3, IMAP, SMTP, and Exchange ActiveSync - and with very few, very limited exceptions, all of these are older protocols which require that the client present the password to the server on every connection. These protocols require us to retain the password for as long as you wish to use the account on the device. Newer protocols don't do this - this is why some of the articles have been contrasting with Gmail, for example. Newer protocols allow the client to use the password one time to generate a token, save the token, and discard the password.

I urge you to review the article linked to in comment #38, which is well-written and quite informative. It provides some very good background on the difference between "obscuring" passwords, and making them truly "secure". Simply obscuring your password (e.g. base64) or encrypting it with a key stored elsewhere will not make your password or your data more secure. An attacker will still be able to retrieve it.

(In particular, some claims have been made about some of the other email clients not storing the password in cleartext. Even where this is true, it does not indicate that the password is more secure. A simple test: if you can boot up the device and it will begin receiving email on your configured accounts, then the passwords are not truly secure. They are either obfuscated, or encrypted with another key stored somewhere else.)

Aditionally, since this issue appears to disturb many Android users, you can also follow this discussion at Slashdot - Android Password Data Stored In Plain Text.

Improve this answer
8
  • 1
    Wow. That amazes me. I wasn't aware of the fact that it is stored in plain text. Forget rooted or not rooted. If your device is stolen, an unscrupulous person could easily obtain your credentials even if you were to lock the phone with a security key. Given this fact, are you also aware of any disk wide encryption mechanisms.
    – asudhak
    Sep 11, 2012 at 23:14
  • 1
    Whatever they are, they're something that can be used to gain access to the account. But, @SachinShekhar, the accounts.db file is protected from being read by accounts other than system.
    – Wyzard
    Sep 12, 2012 at 0:34
  • 1
    Zuul, I appreciate your effort you put in the answers but I think this answer is highly misleading. If you go through the quote you have quoted again, Gmail app doesn't store the password. --edit check @SachinShekhar answer too.
    – roxan
    Sep 12, 2012 at 2:52
  • 2
    @asudhak If any app is using original password, there's NO way to protect it. A hacker can decode encoded string from accounts.db after finding encryption/hashing key which needs to be stored locally because email app would need this key to compile the original password before sending it to server.
    – iOS
    Sep 12, 2012 at 8:46
  • 2
    @roxan I could not find anything that points to the password not being stored by the Gmail app. Can you provide a quote or a link?
    – Flow
    Sep 12, 2012 at 11:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .