Is possible to hide or block access to the shared preferences file?
I'm using this file to store some information about mi apk and I would like to know if is possible not allowed to read or modify the file (including root devices).
Thank You very much in advance
You can store the data in encrypted form in SharedPrefernce. It will be simple approach. also by using proguard tool you can disable the reverse engineering of apk file.
Sadly there would be no way to do that on a device, if a device has root it will have sufficient privileges to read your Shared Preferences as well as your SQLite databases and even Account Manager if it wants to.
You can look into linux file permissions if you want to learn more but any device that has root will be able to access your shared preferences.
If there is sensitive data on in your Shared Preferences just warn the user that if there device is rooted they are at risk. Traditionally for example on Nexus devices if you want to root the device it will wipe the entire thing but on specific devices there are exploits that won't require a wipe so you might be at risk.
Hope that helps.
Related
I have to persist 2 strings for my application even after the application is uninstalled. Regarding that the end users don't have SD cards for their devices and they don't have internet connection, how could I persist those 2 strings even after the app is uninstalled?
I would highly appreciate any response.
Thanks
Unless you're targeting VERY old phones, you don't need to worry about not having external storage. As long as you use Environment.getExternalStorageDirectory() as your reference, you shouldn't have a problem, though if you're absolutely concerned about this you can check if the external storage doesn't exist and then opt to go to internal storage. Check out this link from the developer docs for a little more insight.
If External truly isn't available, you could then save to Internal memory, but you will have to declare a new permission for that, which may ward off some people.
You have to write it to an SD card/internal storage, and hope the user does not remove that. However, this is a very fragile approach. There is no other solution, as far as I know.
Phones internal storage is also treated as an "SD card". If you create a folder and save it in a text file, it should be safe given user does not manually delete folders after uninstall.
Please check out a section "Saving files that should be shared" in the following web page. Making a file that persists after uninstall entails making it available to other apps/user to read and modify. If those file options aren't intended, you should consider an alternative app design.
http://developer.android.com/guide/topics/data/data-storage.html#filesInternal
After re-install, your app can access the created public directory by using the following function:
public static File getExternalStorageDirectory ()
Regarding the function above, per Google:
Note: don't be confused by the word "external" here. This directory can better be thought as media/shared storage. It is a filesystem that can hold a relatively large amount of data and that is shared across all applications (does not enforce permissions). Traditionally this is an SD card, but it may also be implemented as built-in storage in a device that is distinct from the protected internal storage and can be mounted as a filesystem on a computer.
Also, Google recomments placing shared files into a an existing public directory as to not pollute user's root namespace.
Are the strings unique to each user or are they app specific? In either case, the right thing to do would be to save it in some kind of remote server. Firebase is what I use for something like this. Check for its existence in your Application class and download and save it to SQLite if it doesn't exist. For user specific data however, you are going to need some kind of authentication so you know which user is getting what.Firebase does this perfectly well too.
Going by the requirements (no internet, no SD card) of the OP however,I don't see any other way besides one that isn't unethical.
I have a project consisting of four programs for different platforms; all of them use the same XML-based settings file format. I want to be able to manually modify/overwrite it outside of the application. On Windows, Windows Mobile and Linux I'm using "user.home", but on Android that alias isn't implemented. I'm thinking about simply putting it in the Downloads directory, however, that doesn't feel right.
I can't be the only one, who needs that kind of functionality. Or this isn't Android-way? Any suggestions are appreciated.
EDIT: I'm OK with the settings file not being available all the time (i.e. SD-card removed), it's used only on the start-up of the application.
Store it in getExternalFilesDir(). This would work only if the device has an external storage. The user would be able to access it.
However, take note of the following from the docs:
External files are not always available: they will disappear if the
user mounts the external storage on a computer or removes it. See the
APIs on Environment for information in the storage state.
According to Android data storage documentation you have 5 options:
Shared Preferences. By default this will use file /data/data/your.package.name/preferences/user_preferences.xml
Internal Storage. Here you can use something like /data/data/you.package.name/user.home
External Storage. Similar to internal storage /mnt/sdcard/Android/data/your.package.name/user.home, but if user removes memory card file will be inaccessible.
SQLiteDatabase. You can store the whole user.home file in a database blob.
NetworkConnection. Store user's config in a cloud.
My group and I have an application that will work with protected content files that could (or not) contain pretty sensitive information. So we have to ensure they will not be copied by the user.
This question is specifically about the micro USB port. Is there a way to programmatically block it so that the user will be unable to mount trough it to copy our files?
Any and all help/counsel/answers are appreciated. :)
Additional Information:The application will be pat of a custom home application, so we will have that to out advantage, if that is any help.
There is no 100% safe solution for file storage. If you store the files on the SDCard they will have zero protection. If you store them on the internal filesystem you will be protected by file system permissions, which will generally prevent other apps getting to your files. But if the user roots their phone, nothing will stop them getting the files off the phone. Most phones can be rooted.
If you want to protect the sensitive information from your users, look for a way to store it on the network instead. If you only want to protect against other apps, for users that haven't rooted, the internal filesystem should be good enough.
The above are correct and to add, suppose you do disable the USB? Then I'll just Bluetooth them off. Ah, you disabled Bluetooth. OK, I'll use ADB shell over WiFi. Damn, you thought of that too. OK, I'll copy them with Root Explorer to my Dropbox folder. Wait, you got me, I'll email them instead...
You get the picture ;)
I am of the opinion that there is no totally secure file in Android. It's just a question of how difficult you can make it to lock out the 99% of "average" crackers.
Can users with a rooted device view files in the assets folder of my app?
I ask because I intend to place files there that can be accessed from the application, however they should not be viewable in any other way.
I am developing on Froyo 2.2
Yep, sure can. Assets is just another directory on the filesystem of the device. Permissions are enforced on those based on the underlying Linux permissions model, so anyone with access to root on the device can access anything on it.
There is an in-depth discussion of how the assets of applications are isolated/protected, as well as a discuss about how root can access them and how you can protect against this, in Application Security for the Android Platform (disclaimer: I'm the author of this book). Basically, if you're concerned about root having access to files within your application, you're going to want to encrypt them so even if root can get to them, they will not be readable. This approach has a lot of its own implementation problems, all centered on how you manage the keys used to encrypt/decrypt the files. While there are things you can do to make it much more difficult for someone with root to get as your application's files, you cannot make this impossible as root users have full control over the device and everything on it.
Its not possible to prevent anyone getting to your assets.
i'm writing an application that needs to store some data,and picture. For example place's information. this information don't need to change very often. and
I have seen that databases are
stored under /data/data/package_name/databases
I decided to store my data under /data/data/package_name/files.
With the emulator i can see all these files (databases)
under the proposed directories but moving the application on a real
device and installing a file system browser i cannot see any file
under /data. i know that there are some security constrain in (not-rooted) device. However, are there any suggestion about the solution.. where can i store these data and how? because i'm quite new to android. Thanks so much for your help.
The reason you can't see it on the device is basically just as you said; the device isn't rooted, so other apps don't have access to the /data folder.
This is okay though, because you can still store your files there. Your app has access to anything under /data/data/package_name/, you just won't be able to see it in a file browser unless you root. This is normally a good thing, to keep average users from mucking around with your databases/files.
Read up more on storage methods here.