Using Android KeyChain Security

Question

For example, I need to save important data (passwords, tokens, etc.) on the device. Encrypted or non-encrypted data. Will there be a need for android.security KeyChain for secure data storage? If a device user starts their device, will the Keychain data be invulnerable? What is recommended for data security?

Answer 1

This is a very broad question. Perhaps the wiki community already has an answer to it. Anyway, here is a collection of resources related to secure storage in Android that should be useful:

• Android Training: http://developer.android.com/training/articles/security-tips.html
• Credential Storage API: http://nelenkov.blogspot.jp/2012/05/storing-application-secrets-in-androids.html and http://nelenkov.blogspot.no/2013/08/credential-storage-enhancements -android-43.html
  • http://developer.android.com/samples/BasicAndroidKeyStore/index.html
• You can use the Account Manager for accounts and add functions and properties to it to save user data:
  
  • http://developer.android.com/training/sync-adapters/creating-authenticator.html
  • http://developer.android.com/reference/android/accounts/AccountManager.html
  • https://github.com/android/platform_development/tree/master/samples/SampleSyncAdapter
  • http://nelenkov.blogspot.no/2012/11/sso-using-account-manager.html
  • http://udinic.wordpress.com/2013/04/24/write-your-own-android-authenticator/
  • https://groups.google.com/forum/#!topic/android-developers/Vubkbfqimm8
• In general, you should check out Nikolay Elenkov’s blog with lots of good articles on Android and security: http://nelenkov.blogspot.no/