Skip to content
This repository was archived by the owner on Oct 24, 2022. It is now read-only.
This repository was archived by the owner on Oct 24, 2022. It is now read-only.

Possible data loss due obfuscation #16

@noxo

Description

@noxo

private static final String SHARED_PREFERENCES_NAME = CipherPreferencesStorage.class.getName() + "_security_storage";

Current implementation is using class name (CipherPreferencesStorage) as part of shared preferences name (holding the encrypted data). This won't work if Proguard/obfuscation is used in project; classname of CipherPreferencesStorage will be scrambled by obfuscator (unless exclusion rule is added), and shared prefs name could vary per build - resulting in loss of data between builds.

  1. Build app without obfuscation, data is available via com.github.leonardoxh.keystore.store.CipherPreferencesStorage_security_storage.xml shared pref
  2. Recompile same app with obfucation, data is available via ab.c.d_security_storage.xml shared pref
  3. Modify deps, recompile same app with obfucation, data is available via ab.c.e.d_security_storage.xml shared pref

= implementation should not use classname in shared pref name as it will not remain consistant between builds if obfuscation is used

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions