encrypt data in SharedPreferences

Question

Im currently developing a framework for oAuth 1 and 2 access to webservices and my question is, how do i store sensitive data like an oAuth access key in a secure way? the problem with this keys is that some platforms like twitter use a permanent key and if someone would get access to this key he could do whatever he wants with the users twitter account..

so is it possible to automatically encrypt the data before it is stored in the shared preferences? Or is there a better way/place to store very important data?

UPDATE - ALSO READ: What is the most appropriate way to store user settings in Android application

Answer 1

This article on codeproject contains a nice wrapper for the shared prefs. However the class name SecurePreferences is misleading something like ObfuscatedPreferences would be more appropriate.

Answer 2

See duplicate: Obfuscate/Encrypt SharedPreferences file possible?

Hi, I've created a SharedPreferences implementation using AES encryiption. The project is a maven module. If you need one, take a look. https://github.com/kovmarci86/android-secure-preferences

Answer 3

new encryption introduce by facebook - conceal Encryption.. easy to use

https://github.com/afiqiqmal/ConcealSharedPreference-Android

Answer 4

You should take a look at Slink. I came to realize that most of the SharedPreferences encryption tools use encryption for each action you make, meaning that each key-value pair is saved only after both key and value been encrypted, separately. This creates a big performance overhead.

So I searched for a library that will give me a more efficient encryption process and I found Slink. Slink uses Facbook's Conceal library to save the entire map of objects as a whole, making it the most efficient and fast SharedPreferences encryption solution. It also uses common Android's SharedPreferences interfaces, which makes the usage extremely easy and almost seamless. Disclaimer: I'm part of the development team developing this library.

Answer 5

There is an Android Library that uses Facebook Conceal to encrypt data.

https://github.com/rtoshiro/SecureSharedPreferences

Maven Central:

compile 'com.github.rtoshiro.securesharedpreferences:securesharedpreferences:1.0.+'

Answer 6

You can encrypt the data in preferences and keep the encryption key in the Android Keystore system. This way your encryption key would also be safe.

You can look into a library doing this https://github.com/ophio/secure-preferences