Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

0x5d - Android AccountManager not yet addressed #1890

Open
cpholguera opened this issue Apr 4, 2021 · 3 comments
Open

0x5d - Android AccountManager not yet addressed #1890

cpholguera opened this issue Apr 4, 2021 · 3 comments
Labels
Android MASVS-AUTH

Comments

@cpholguera
Copy link
Collaborator

cpholguera commented Apr 4, 2021 •
edited
Loading

Security implications? when to use it instead of the Keystore?
@jessystecroix717
Copy link

https://github.com/OWASP/owasp-mstg/issues/1890#issue-849928348

@jessystecroix717
Copy link

@

@cpholguera cpholguera changed the title Android AccountManager not yet addressed 0x5d - Android AccountManager not yet addressed Oct 18, 2021
@cpholguera
Copy link
Collaborator Author

  • in general to avoid storing user credentials it's better to use the AccountManager whenever possible.
  • if multiple apps should use the same credential it's better to use the AccountManager.
  • if only one application uses the credential, you might use a KeyStore for storage.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Android MASVS-AUTH
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@cpholguera @jessystecroix717