使用 Google 帐户进行安全 Android 身份验证
我的应用程序将处理敏感数据（私钥），因此必须有一种安全的方式来访问这些数据。我想将用户身份验证的负担转嫁给 Google，并让他们根据验证其 Google 帐户信息来确定用户是否可以访问该应用程序。我正在考虑使用 WebView 和 OpenID 协议，但作为一个更加基于 Web 的协议，我仍在考虑其他选项。另一个要求是，用户每次希望访问应用程序时都必须进行身份验证，如果应用程序暂停，可能需要 90 秒的窗口。
带有 OpenID 的 WebView 对我来说是最好的解决方案吗？或者有人可以推荐更好的方法吗？
My application will be handling sensitive data (private keys) and therefore must have a secure way of accessing this data. I would like to pass the user authentication burden on to Google and have them determine if the user can have access to the app or not based on verifying their Google account information. I was looking into using a WebView and using the OpenID protocol, but being a more web based protocol I am still considering other options. Another requirement would also be that the user MUST authenticate every time they wish to access the app, possibly with a 90sec window if the app is paused.
Is the WebView with OpenID the best solution for me or can anyone recommended a better approach?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我认为最好的方法是使用 AccountManager。 AccountManager 实际上拥有用户 Google 帐户的用户名和密码，但您无法访问该信息。您可以向 AccountManager 请求用户拥有的某个帐户的令牌。如果您想要 Google 帐户的令牌，则必须请求“com.google”帐户。当您向 AccountManager 请求令牌时，将启动一个活动来询问用户是否允许应用程序访问其帐户。
此外，您还可以请求对某种服务有用的令牌。如果您想访问 Blogger 信息。您可以请求“博主”许可。 AccountManager 将返回给您的令牌仅适用于该服务。
令牌会在一段时间后过期，因此您必须检查。当令牌不再有效时，您必须告诉 AccountManager，令牌不再有效。下次您请求令牌时，AccountManager 将为您提供一个新令牌。
寻找 Google 的 AccountManager。
http://developer.android.com/reference/android/accounts/AccountManager.html
它适用于 Android 2.1 及更高版本。
I think that the best way to do this is using the AccountManager. The AccountManager actually has the user and password from user's google account, but you can't access that information. You can ask the AccountManager for a token for some account that the user has. If you want a token for a Google account, you have to ask for a "com.google" account. When you ask the AccountManager for a token, an activity will be launched to ask the user if he wants to allow the application access his account.
Also, you can ask for a token that is useful for a kind of service. If you want access to Blogger information. You can ask for "blogger" permission. The token that the AccountManager will give you back, will work only for that service.
The token expires after some time, so you will have to check. When the token doesn't work anymore, you will have to tell the AccountManager, that the token is no more valid. Next time that you ask for a token, the AccountManager will give you a new one.
Look for AccountManager at Google.
http://developer.android.com/reference/android/accounts/AccountManager.html
It works on Android 2.1 and superior versions.