Storing password for an offline app

Question

I'm developing an app where the user can use it in remote locations. I've created a startup dialog asking for password. I saved the password in SharedPreferences.

My question is, is it a good idea to do that? Or is there a better way for storing passwords for offline apps?

Because when I try to clear the data of my app in settings -> apps, my saved password in SharedPreferencesis also being deleted.

Answer 1

Basically clear data of your app is cleaning what you store in SharedPreferences so that is normal. Store data in with SharedPreferences is usefull but someone with a rooted devices can access to these datas (basically an xml file store in "/data/data/app_packages"). Then you seriously have to consider to encrypt your password before to store it with SharedPreferences.

Answer 2

My question is, is it a good idea to do that?

Generally, it is not a good idea to store passwords in plaintext, even if it is an offline application and gets cleared sometimes anyway. Like you mentioned before, all that Information and even the database can be extracted from your Applicatoin Storage when the device is rooted. Even If the content of that application is trivial, someone can do what mentioned above, just to see what password you use, so he/she can try to hack other accounts of yours.. This is especially the case if more people are using this application.

If you are aware of, and OK with that, you surely can use SP or DB. If you want to do something in the right direction, you can encrypt passwords, or hash them (though I recommend not to use MD5, but something like SHA2,Whirlpool,RipeMD2 or even PBKDF2). Using an encrypted Database like SQLCipher is also nice, since you have to set it up only once, and everything that is added in to your application afterwards is automatically stored encrypted.

If your only concern is that you dont want to the passwords be deleted, well, if you don't have Server communication, you have to live with that risk :)

Answer 3

you can hash your password and store it in a file

search for hash function like MD5 or ..