blocks|key|233959|text|将它们存储为shared+preferences。默认情况下，这些是私有的，其他应用程序无法访问它们。在有根的设备上，如果用户明确允许访问正在尝试读取它们的应用程序，则该应用程序可能能够使用它们，但您无法阻止这一点。至于加密，您必须要求用户每次都输入解密密码(从而违背了缓存凭据的目的)，或者将密钥保存到文件中，您将得到相同的问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|233960|存储令牌而不是实际的用户名密码有几个好处：|233961|233962|第三方应用程序不需要知道密码，用户可以确保仅将密码发送到原始站点(Facebook、Twitter、Gmail等)|unordered-list-item|233963|即使有人窃取令牌，他们也看不到密码(用户可能也在其他站点上使用)|233964|令牌通常具有生存期并在一段时间后过期如果您怀疑令牌已被泄露|233965|令牌可被撤销|233966|<代码>F210|233967|entityMap|0|LINK|mutability|MUTABLE|url|https://developer.android.com/reference/android/content/SharedPreferences^0|6|I|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Z|8|@]|9|@$A|10|B|11|1|12]]|C|$]]|$1|D|3|E|5|6|7|13|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|14|8|@]|9|@]|C|$]]|$1|G|3|H|5|I|7|15|8|@]|9|@]|C|$]]|$1|J|3|K|5|I|7|16|8|@]|9|@]|C|$]]|$1|L|3|M|5|I|7|17|8|@]|9|@]|C|$]]|$1|N|3|O|5|I|7|18|8|@]|9|@]|C|$]]|$1|P|3|Q|5|6|7|19|8|@]|9|@]|C|$]]|$1|R|3|-4|5|6|7|1A|8|@]|9|@]|C|$]]]|S|$T|$5|U|V|W|C|$X|Y]]]]

Store them as <a href="https://developer.android.com/reference/android/content/SharedPreferences" rel="noreferrer">shared preferences</a>. Those are by default private, and other apps cannot access them. On a rooted devices, if the user explicitly allows access to some app that is trying to read them, the app might be able to use them, but you cannot protect against that. As for encryption, you have to either require the user to enter the decrypt passphrase every time (thus defeating the purpose of caching credentials), or save the key to a file, and you get the same problem. 

There are a few benefits of storing tokens instead of the actual username password:

<ul>
<li>Third party apps don't need to know the password and the user can be sure that they only send it to the original site (Facebook, Twitter, Gmail, etc.)</li>
<li>Even if someone steals a token, they don't get to see the password (which the user might be using on other sites too)</li>
<li>Tokens generally have a lifetime and expire after a certain time</li>
<li>Tokens can be revoked if you suspect they have been compromised</li>
</ul>

blocks|key|2891388|text|您可以将它们存储在AccountManager中。根据这些人的说法，这被认为是最佳实践。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2891389|​|2891390|📷|atomic|2891391|2891392|以下是官方定义：|2891393|2891394|此类提供对用户在线帐户的集中注册表的访问。用户为每个帐户输入一次凭据(用户名和密码)，通过“一键”批准授予应用程序对在线资源的访问权限。|blockquote|2891395|2891396|2891397|有关如何使用AccountManager的详细指南，请参阅：|2891398|2891399|Udi+Cohen+tutorial|unordered-list-item|2891400|Pilanites+blog|2891401|Google+IO+presentation|2891402|2891403|但是，最终AccountManager只将您的令牌存储为纯文本。因此，我建议在将您的秘密存储到AccountManager之前对其进行加密。您可以利用各种加密库，如AESCrypt或AESCrypto|2891404|另一种选择是使用Conceal+library。它对Facebook来说足够安全，而且比AccountManager更容易使用。下面是使用隐藏保存秘密文件的代码片段。|2891405|byte[]+cipherText+=+crypto.encrypt(plainText);
byte[]+plainText+=+crypto.decrypt(cipherText);|code-block|syntax|javascript|2891406|entityMap|0|LINK|mutability|MUTABLE|url|https://developer.android.com/reference/android/accounts/AccountManager.html|1|IMAGE|IMMUTABLE|imageUrl|https://ask.qcloudimg.com/http-save/yehe-900000/5c971f4376457b633d031febab2bf400.png|imageAlt|2|http://blog.udinic.com/2013/04/24/write-your-own-android-authenticator/|3|http://www.pilanites.com/android-account-manager/|4|https://www.youtube.com/watch?v=9fBcrzA-hWY|5|https://github.com/scottyab/AESCrypt-Android|6|https://github.com/tozny/java-aes-crypto|7|https://github.com/facebookarchive/conceal^0|9|E|0|0|0|0|1|1|0|0|0|0|0|0|0|0|0|0|I|2|0|0|E|3|0|0|M|4|0|0|2A|8|5|2J|9|6|0|8|F|7|0|0^^$0|@$1|2|3|4|5|6|7|21|8|@]|9|@$A|22|B|23|1|24]]|C|$]]|$1|D|3|E|5|6|7|25|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|26|8|@]|9|@$A|27|B|28|1|29]]|C|$]]|$1|I|3|E|5|6|7|2A|8|@]|9|@]|C|$]]|$1|J|3|K|5|6|7|2B|8|@]|9|@]|C|$]]|$1|L|3|-4|5|6|7|2C|8|@]|9|@]|C|$]]|$1|M|3|N|5|O|7|2D|8|@]|9|@]|C|$]]|$1|P|3|-4|5|6|7|2E|8|@]|9|@]|C|$]]|$1|Q|3|-4|5|6|7|2F|8|@]|9|@]|C|$]]|$1|R|3|S|5|6|7|2G|8|@]|9|@]|C|$]]|$1|T|3|-4|5|6|7|2H|8|@]|9|@]|C|$]]|$1|U|3|V|5|W|7|2I|8|@]|9|@$A|2J|B|2K|1|2L]]|C|$]]|$1|X|3|Y|5|W|7|2M|8|@]|9|@$A|2N|B|2O|1|2P]]|C|$]]|$1|Z|3|10|5|W|7|2Q|8|@]|9|@$A|2R|B|2S|1|2T]]|C|$]]|$1|11|3|-4|5|6|7|2U|8|@]|9|@]|C|$]]|$1|12|3|13|5|6|7|2V|8|@]|9|@$A|2W|B|2X|1|2Y]|$A|2Z|B|30|1|31]]|C|$]]|$1|14|3|15|5|6|7|32|8|@]|9|@$A|33|B|34|1|35]]|C|$]]|$1|16|3|17|5|18|7|36|8|@]|9|@]|C|$19|1A]]|$1|1B|3|-4|5|6|7|37|8|@]|9|@]|C|$]]]|1C|$1D|$5|1E|1F|1G|C|$1H|1I]]|1J|$5|1K|1F|1L|C|$1M|1N|1O|-4]]|1P|$5|1E|1F|1G|C|$1H|1Q]]|1R|$5|1E|1F|1G|C|$1H|1S]]|1T|$5|1E|1F|1G|C|$1H|1U]]|1V|$5|1E|1F|1G|C|$1H|1W]]|1X|$5|1E|1F|1G|C|$1H|1Y]]|1Z|$5|1E|1F|1G|C|$1H|20]]]]

You can store them in <a href="https://developer.android.com/reference/android/accounts/AccountManager.html" rel="noreferrer">AccountManager</a>. It's considered best practice according to these guys.
<a href="https://i.stack.imgur.com/oT3jR.png" rel="noreferrer"><img src="https://i.stack.imgur.com/oT3jR.png" alt="enter image description here" /></a>
Here's the official definition:
<blockquote>
This class provides access to a centralized registry of the user's
online accounts. The user enters credentials (username and password)
once per account, granting applications access to online resources
with &quot;one-click&quot; approval.
</blockquote>
For detailed guide on how to use AccountManager:
<ul>
<li><a href="http://blog.udinic.com/2013/04/24/write-your-own-android-authenticator/" rel="noreferrer">Udi Cohen tutorial</a></li>
<li><a href="http://www.pilanites.com/android-account-manager/" rel="noreferrer">Pilanites blog</a></li>
<li><a href="https://www.youtube.com/watch?v=9fBcrzA-hWY" rel="noreferrer">Google IO presentation</a></li>
</ul>
However, in the end AccountManager only stores your token as a plain text. So, I would suggest encrypting your secret before storing them in AccountManager. You can utilize various Encryption library like <a href="https://github.com/scottyab/AESCrypt-Android" rel="noreferrer">AESCrypt</a> or <a href="https://github.com/tozny/java-aes-crypto" rel="noreferrer">AESCrypto</a>
Another option is to use <a href="https://github.com/facebookarchive/conceal" rel="noreferrer">Conceal library</a>. It's safe enough for Facebook and much easier to use than AccountManager. Here's a code snippet to save a secret file using Conceal.
<pre><code>byte[] cipherText = crypto.encrypt(plainText);
byte[] plainText = crypto.decrypt(cipherText);
</code></pre>

blocks|key|228718|text|type|unstyled|depth|inlineStyleRanges|entityRanges|data|228719|从Android+Studio的项目窗格中，选择“项目文件”，并在项目的根目录中创建一个名为"keystore.properties“的新文件。|ordered-list-item|228720|228721|​|228722|📷|atomic|offset|length|228723|228724|228725|打开"keystore.properties“文件，并将您的访问令牌和密钥保存在该文件中。|228726|228727|228728|228729|228730|228731|现在加载应用程序模块的build.gradle文件中的读取访问令牌和密码。然后，您需要为您的访问令牌和密码定义BuildConfig变量，以便您可以从代码中直接访问它们。您的build.gradle可能如下所示：|style|BOLD|228732|228733|...+...。android+{+compileSdkVersion+26+//从keystore.properties文件中加载值def+keystorePropertiesFile+=+rootProject.file("keystore.properties")+def+keystoreProperties+=新属性()keystoreProperties.load(新FileInputStream(keystorePropertiesFile))+defaultConfig+{+applicationId+"com.yourdomain.appname“minSdkVersion+16+targetSdkVersion+26+versionCode+1+versionName+"1.0”testInstrumentationRunner+android//创建字符串变量buildConfigField“BuildConfig”，"ACCESS_TOKEN"，keystoreProperties"ACCESS_TOKEN“buildConfigField+"String"，"+Secret+"，keystoreProperties"SECRET”}}|228734|您可以在代码中使用访问令牌和密码，如下所示：|unordered-list-item|228735|228736|String+secret+=+BuildConfig.SECRET;；String+accessToken+=BuildConfig.ACCESS_TOKEN|228737|这样，您就不需要在项目中以纯文本形式存储访问令牌和Secret。因此，即使有人反编译你的APK，他们也永远不会得到你的访问令牌和密码，因为你是从外部文件加载它们。|228738|entityMap|0|IMAGE|mutability|IMMUTABLE|imageUrl|https://ask.qcloudimg.com/http-save/yehe-900000/6fb1e576dddb5d1ce6ec96c6f0262263.png|imageAlt|1|https://ask.qcloudimg.com/http-save/yehe-900000/446724b48522077acfc8d3684b1217ff.png^0|0|0|0|0|0|1|0|0|0|0|0|0|0|0|1|1|0|0|0|4|4|B|C|2F|C|0|0|0|0|0|0|0^^$0|@$1|2|3|-4|4|5|6|1K|7|@]|8|@]|9|$]]|$1|A|3|B|4|C|6|1L|7|@]|8|@]|9|$]]|$1|D|3|-4|4|5|6|1M|7|@]|8|@]|9|$]]|$1|E|3|F|4|5|6|1N|7|@]|8|@]|9|$]]|$1|G|3|H|4|I|6|1O|7|@]|8|@$J|1P|K|1Q|1|1R]]|9|$]]|$1|L|3|F|4|5|6|1S|7|@]|8|@]|9|$]]|$1|M|3|-4|4|5|6|1T|7|@]|8|@]|9|$]]|$1|N|3|O|4|C|6|1U|7|@]|8|@]|9|$]]|$1|P|3|-4|4|5|6|1V|7|@]|8|@]|9|$]]|$1|Q|3|F|4|5|6|1W|7|@]|8|@]|9|$]]|$1|R|3|H|4|I|6|1X|7|@]|8|@$J|1Y|K|1Z|1|20]]|9|$]]|$1|S|3|F|4|5|6|21|7|@]|8|@]|9|$]]|$1|T|3|-4|4|5|6|22|7|@]|8|@]|9|$]]|$1|U|3|V|4|C|6|23|7|@$J|24|K|25|W|X]|$J|26|K|27|W|X]|$J|28|K|29|W|X]]|8|@]|9|$]]|$1|Y|3|-4|4|5|6|2A|7|@]|8|@]|9|$]]|$1|Z|3|10|4|5|6|2B|7|@]|8|@]|9|$]]|$1|11|3|12|4|13|6|2C|7|@]|8|@]|9|$]]|$1|14|3|-4|4|5|6|2D|7|@]|8|@]|9|$]]|$1|15|3|16|4|5|6|2E|7|@]|8|@]|9|$]]|$1|17|3|18|4|5|6|2F|7|@]|8|@]|9|$]]|$1|19|3|-4|4|5|6|2G|7|@]|8|@]|9|$]]]|1A|$1B|$4|1C|1D|1E|9|$1F|1G|1H|-4]]|1I|$4|1C|1D|1E|9|$1F|1J|1H|-4]]]]

<ol>
<li>From your Android Studio's Project pane, select "Project Files" and create a new file named "keystore.properties" in your project's root directory.</li>
</ol>

<a href="https://i.stack.imgur.com/69UJB.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/69UJB.png" alt="enter image description here"></a>

<ol start="2">
<li>Open "keystore.properties" file and save your Access Token and Secret in the file.</li>
</ol>

<a href="https://i.stack.imgur.com/y9wld.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/y9wld.png" alt="enter image description here"></a>

<ol start="3">
<li>Now load the read the Access Token and Secret in your app module's build.gradle file. Then you need to define the BuildConfig variable for your Access Token and Secret so that you can you can directly access them from your code. Your build.gradle may look like following:

<pre><code>... ... ... 

android {
 compileSdkVersion 26

 // Load values from keystore.properties file
 def keystorePropertiesFile = rootProject.file("keystore.properties")
 def keystoreProperties = new Properties()
 keystoreProperties.load(new FileInputStream(keystorePropertiesFile))

 defaultConfig {
 applicationId "com.yourdomain.appname"
 minSdkVersion 16
 targetSdkVersion 26
 versionCode 1
 versionName "1.0"
 testInstrumentationRunner "android.support.test.runner.AndroidJUnitRunner"

 // Create BuildConfig variables
 buildConfigField "String", "ACCESS_TOKEN", keystoreProperties["ACCESS_TOKEN"]
 buildConfigField "String", "SECRET", keystoreProperties["SECRET"]
 }
}
</code></pre></li>
<li>You can use your Access Token and Secret in your code like this:

<pre><code>String accessToken = BuildConfig.ACCESS_TOKEN;
String secret = BuildConfig.SECRET;
</code></pre></li>
</ol>

This way you don't need store the Access Token and Secret in plain text inside your project. So even if someone decompiles your APK, they will never get your Access Token and Secret as you are loading them from a external file.

blocks|key|2891516|text|SharedPreferences+is+not本身就是一个安全的位置。在一个有根的设备上，我们可以很容易地读取和修改所有应用程序的SharedPrefereces+xml，所以令牌应该相对频繁地过期。但是，即使每小时有一个令牌过期，仍有可能从SharedPreferences窃取较新的令牌。安卓KeyStore应该用于长期存储和检索密钥，这些密钥将用于加密我们的令牌，以便将它们存储在例如SharedPreferences或数据库中。密钥不存储在应用程序的进程中，因此它们可能会被are+harder泄露。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2891517|因此，比地点更相关的是它们如何本身是安全的，例如，使用加密签名的短寿命JWTs，使用Android+KeyStore加密它们，并使用安全协议发送它们。|2891518|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#shared-preferences|1|https://developer.android.com/training/articles/keystore.html#SecurityFeatures^0|I|6|0|6Q|A|1|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@$A|Q|B|R|1|S]|$A|T|B|U|1|V]]|C|$]]|$1|D|3|E|5|6|7|W|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|X|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]|N|$5|I|J|K|C|$L|O]]]]

SharedPreferences <a href="https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05d-Testing-Data-Storage.md#shared-preferences" rel="noreferrer">is not</a> a secure location itself. On a rooted device we easily can read and modify all applications' SharedPrefereces xml's. So tokens should expire relatively frequent. But even if a token expires every hour, newer tokens can still be stolen from SharedPreferences. Android KeyStore should be used for long term storage and retrieval of cryptographic keys which will be used to encrypt our tokens in order to store them in e.g. SharedPreferences or a database. The keys are not stored within an application's process, so they <a href="https://developer.android.com/training/articles/keystore.html#SecurityFeatures" rel="noreferrer">are harder</a> to be compromised.

So more relevant than a place is how they can be itself secure e.g. using cryptographically signed short-living JWTs, encrypting them using Android KeyStore and sending them with a secure protocol

I am going to use oAuth to fetch mails and contacts from google. I don't want to ask the user each time to log in to obtain an access token and secret. From what I understood, I need to store them with my application either in a database or <code>SharedPreferences</code>. But I am a bit worried about security aspects with that. I read that you can encrypt and decrypt the tokens but it is easy for an attacker to just decompile your apk and classes and get the encryption key. 
What's the best method to securely store these tokens in Android?

How to securely store access token and secret in Android?

Android Studio

数据库

Android

我将使用oAuth从谷歌获取邮件和联系人。我不想每次都要求用户登录以获取访问令牌和密码。据我所知，我需要将它们与我的应用程序一起存储在数据库或SharedPreferences中。但我有点担心安全方面的问题。我读到你可以加密和解密令牌，但攻击者很容易只需反编译你的apk和类，并获得加密密钥。在安卓中安全存储这些令牌的最...

问如何在Android中安全地存储访问令牌和密钥？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在Android中安全地存储访问令牌和密钥？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在Android中安全地存储访问令牌和密钥？
EN