Android：存储用户名和密码？
如果我想存储在 Android 应用程序中使用的用户名和密码，最好的方法是什么？是通过首选项屏幕（但如果用户错过了这个怎么办？），还是弹出一个对话框并询问用户凭据？如果是这样，我确实必须维护应用程序的状态。我该怎么做？
If I want to store the username and password to be used inside an Android application, what is the best way to do it? Is it through the preferences screen (but what if the user misses this?), or pop up a dialog box and ask the user for the credentials? If so, I do have to maintain state for the application. How would I do this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（9）
我见过的大多数 Android 和 iPhone 应用程序都使用初始屏幕或对话框来请求凭据。我认为用户必须经常重新输入名称/密码很麻烦，因此从可用性的角度来看，存储该信息是有意义的。
(Android 开发指南) 的建议是：
使用 AccountManger 是存储凭据的最佳选择。 SampleSyncAdapter 提供了如何使用它的示例。
如果由于某种原因这不是您的选择，您可以使用 偏好机制。其他应用程序将无法访问您的首选项，因此用户的信息不会轻易暴露。
Most Android and iPhone apps I have seen use an initial screen or dialog box to ask for credentials. I think it is cumbersome for the user to have to re-enter their name/password often, so storing that info makes sense from a usability perspective.
The advice from the (Android dev guide) is:
Using the AccountManger is the best option for storing credentials. The SampleSyncAdapter provides an example of how to use it.
If this is not an option to you for some reason, you can fall back to persisting credentials using the Preferences mechanism. Other applications won't be able to access your preferences, so the user's information is not easily exposed.
您应该使用 Android AccountManager。它是专门针对这种情况而构建的。这有点麻烦，但它所做的事情之一是，如果 SIM 卡发生变化，本地凭据就会失效，因此，如果有人刷了您的手机并放入了新的 SIM 卡，您的凭据不会受到损害。
这还为用户提供了一种快速、简单的方法来访问（并可能删除）他们在设备上拥有的任何帐户的存储凭据，所有这些都从一个地方进行。
SampleSyncAdapter（如@Miguel 提到的）是一个使用存储的帐户凭据的示例。
You should use the Android AccountManager. It's purpose-built for this scenario. It's a little bit cumbersome but one of the things it does is invalidate the local credentials if the SIM card changes, so if somebody swipes your phone and throws a new SIM in it, your credentials won't be compromised.
This also gives the user a quick and easy way to access (and potentially delete) the stored credentials for any account they have on the device, all from one place.
SampleSyncAdapter (like @Miguel mentioned) is an example that makes use of stored account credentials.
我认为保护您的凭据的最佳方法是首先考虑将密码加密存储在 account.db 文件中，该文件在非 root 设备中不容易获得，如果是 root 设备，黑客必须需要密钥才能解密它。
其他选项是像 Gmail 那样进行所有身份验证。与 Gmail 服务器进行第一次身份验证后。您获得了可在您的密码时使用的身份验证令牌。该令牌将以纯文本形式存储。如果您从服务器更改密码，则该令牌可能为假。
我建议您启用 2-Factor Authentication & 最后一个选项为您的设备创建设备特定密码。丢失设备后，您所需要做的就是禁用该设备。
I think the best way to secure your credential is to first think of storing the Password with encryption in the account.db file which couldn't be easily available in non rooted devices and in case of rooted device the hacker must need the key to decrypt it.
Other option is do all your authentication like the way Gmail is doing. after the first authentication with the Gmail server . you got the Auth Token that would be use in case of your password . that token would be store in plain text.this token could be false in case you change the password from Server.
the last option I'd recommend you to enable 2-Factor Authentication & create Device Specific Password for your device. After losing device, all you need is to disable that device.
看看
Take a look at What is the most appropriate way to store user settings in Android application if you're concerned about storing passwords as clear text in SharedPreferences.
您还可以查看 SDK 中的 SampleSyncAdapter 示例。它可能对你有帮助。
You can also look at the SampleSyncAdapter sample from the SDK. It may help you.
看一下 Android 开发者的这篇文章，它可能有助于提高 Android 应用程序中存储数据的安全性。
使用加密技术安全地存储凭据
Take a look at this this post from android-developers, that might help increasing the security on the stored data in your Android app.
Using Cryptography to Store Credentials Safely
使用新的 (Android 6.0) 指纹硬件和 API，您可以按照此 github 中的方式进行操作示例应用程序。
With the new (Android 6.0) fingerprint hardware and API you can do it as in this github sample application.
这些按破解隐藏信息的难度顺序排列。
以明文形式存储
使用对称密钥加密存储
使用 Android 密钥库
使用非对称密钥加密存储
源：在 Android 应用中存储密码的最佳位置
来源： 简单使用 Android Keystore 来存储密码和其他敏感信息
These are ranked in order of difficulty to break your hidden info.
Store in cleartext
Store encrypted using a symmetric key
Using the Android Keystore
Store encrypted using asymmetric keys
source: Where is the best place to store a password in your Android app
source: Simple use the Android Keystore to store passwords and other sensitive information
信息位于 http://nelenkov.blogspot.com/ 2012/05/storing-application-secrets-in-androids.html 是一种相当实用的、但基于“uses-hidden-android-apis”的方法。当您确实无法在设备本地存储凭据/密码时，需要考虑这一点。
我还在 https://gist.github.com/kbsriram/ 创建了该想法的清理要点5503519 这可能会有所帮助。
The info at http://nelenkov.blogspot.com/2012/05/storing-application-secrets-in-androids.html is a fairly pragmatic, but "uses-hidden-android-apis" based approach. It's something to consider when you really can't get around storing credentials/passwords locally on the device.
I've also created a cleaned up gist of that idea at https://gist.github.com/kbsriram/5503519 which might be helpful.