Need Help From Some Advanced Users!

[bigsupersquid]

I just got this from KSmithInNY:

Security bulletin for rooted users: Android passwords stored as clear text | Android Central

Any app with root access has the ability to get your google credentials because android stores them in plain text. Wonderful!

eww.
knew there was another good reason for not flashing the gapps with the ROM. I'm just greedy about my RAM and CPU use, more than worried about info vulnerability.
I use the web versions of all the apps instead, with their own data storage insecurities and vulnerabilities to the Man's enforcers, to cut down on system resource parasitic daemons living on my hardware.
no google sync for me anymore, thank you!

 

[mmarz]

eww.
knew there was another good reason for not flashing the gapps with the ROM. I'm just greedy about my RAM and CPU use, more than worried about info vulnerability.
I use the web versions of all the apps instead, with their own data storage insecurities and vulnerabilities to the Man's enforcers, to cut down on system resource parasitic daemons living on my hardware.
no google sync for me anymore, thank you!

Seriously, it has gotten to the point where I need to have separate google accounts to ensure privacy. Otherwise one password kept in plain text and available to all root privileged apps can access your email, texts, phone calls, location, the location of your friends, online shopping, online documents....ect.

 

[vegetajin8]

After reading that article I'm thinking about unrooting. Or buying a new phone.

Sent from my LG-VM670 using Tapatalk

 

[mmarz]

Ok so I have investigated this further, and I am 100% worried again. The security bulletin posted above does not seem to apply in this situation. While google's framework allows for passwords to be stored unencrypted, the Optimus V does encrypt your google account password. You can check this on your rooted phone by examining the file /data/system/accounts.db. Besides the password being encrypted, it is stored on the micro sd card because of my data2ext setup.

This means that once again, my password is being stored somewhere on my phone by some process, without my control in plain text and this is most likely not google's default security settings to blame.

I encourage all of you to try out dumping your phone's memory and searching to see if your passwords pop up

 

[bigsupersquid]

...This means that once again, my password is being stored somewhere on my phone by some process, I encourage all of you to try out dumping your phone's memory and searching to see if your passwords pop up

I'll do it on principle, mostly to see what's in there, but doubt I'll find anything because I don't have any apps on my phone which sign in to anything or sync or whatever. the best security is manually signing in to services, except for keyloggers or RF receivers or network hackers or abuse of political power...

 

[JerryScript]

Perhaps the old school method of changing your password frequently would apply here.