Comments on: Bug/Hole/Feature(?) of Android - Any application can access your google credentials

By: nameless1

nameless1 — Wed, 05 Dec 2007 21:33:26 +0000

Could this be their intention? I could see the argument for this feature, that if you sign in at the beginning - you would want all the other apps that use Google features to authenticate w/o requiring user action. Seems to be a big hole miss if this wasn’t their intention.

By: Peter Blazejewicz

Peter Blazejewicz — Mon, 26 Nov 2007 11:01:39 +0000

Hi Davanum,
I believe that is becuase of:
- prelease version
- lack of documentation
- lack of security measures implemented in emulator (we can query intents but we are not required to authorize to use them if exposed).
There is a lot of undocumented Google api in SDK so that seems reasonable they provide system-wide authorization service - otherwise it could be difficult to write custom one. That way we will have access to existing authorization to G apis i think,

regards,
Peter

By: Un vrai bug sur Android?

Un vrai bug sur Android? — Sun, 25 Nov 2007 21:14:57 +0000

[...] il se pourrait qu’une vraie faille d’Android ait été découverte par Davanum, encore lui ! Cette faille permettrait à n’importe quelle [...]

By: solydzajs

solydzajs — Sun, 25 Nov 2007 20:03:34 +0000

I’ve tested your code and it seems that content://googleaccounts/accounts/ returns login and hashed password, however content://settings/googlelogin returns login and password in plain text, so basically any application can read your account settings.

I wonder how this account credentials will be accessible in the final Android release. May be it’s just a matter of permissions settings in AndroidManifest.xml ?

Best,
Pawel Solyga