Android SharedPreference 安全性
我想知道共享偏好的安全性。
是否可以访问共享首选项，即使它们是在 MODE_PRIV (0) 中创建的？
是否可以列出所有可用的共享首选项，然后从其他应用程序获取所有设置？
SharedPreferences 是放置敏感数据（例如密码或身份验证令牌）的好地方吗？
谢谢
I wonder about shared preferences security.
Is it possible to get access to sharedpreferences, even if they were created in MODE_PRIV (0) ?
Is it possible to list all sharedpreferences available and then fetch all settings from other apps?
Is sharedpreferences good place to put sensitive data, such as password or auth token?
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
共享首选项作为文件存储在设备上的文件系统中。默认情况下，它们存储在应用程序的数据目录中，并设置了文件系统权限，仅允许特定应用程序运行时使用的 UID 访问它们。因此，它们是私有的，因为 Linux 文件权限限制对它们的访问，就像在任何 Linux/Unix 系统上一样。
任何对设备具有 root 级别访问权限的人都可以看到它们，因为 root 可以访问文件系统上的所有内容。此外，任何使用与创建应用程序相同的 UID 运行的应用程序都能够访问它们（这通常不会完成，您需要采取特定操作来使两个应用程序使用相同的 UID 运行，因此这可能不是一个大问题忧虑）。最后，如果有人能够在不使用已安装的 Android 操作系统的情况下挂载您设备的文件系统，他们也可以绕过限制访问的权限。
如果您担心对您的首选项（或您的应用程序写入的任何数据）的此类访问，那么您将需要对其进行加密。如果您非常担心它们，您将需要准确计算出针对您所看到的风险级别需要多少保护。 Android 平台的应用程序安全性对此进行了非常广泛的讨论，刚刚发布于2011 年 12 月（免责声明：我是本书的作者）。
Shared Preferences are stored as a file in the filesystem on the device. They are, by default, stored within the app's data directory with filesystem permissions set that only allow the UID that the specific application runs with to access them. So, they are private in so much as Linux file permissions restrict access to them, the same as on any Linux/Unix system.
Anyone with root level access to the device will be able to see them, as root has access to everything on the filesystem. Also, any application that runs with the same UID as the creating app would be able to access them (this is not usually done and you need to take specific action to make two apps runs with the same UID, so this is probably not a big concern). Finally, if someone was able to mount your device's filesystem without using the installed Android OS, they could also bypass the permissions that restrict access.
If you're concerned about such access to your preferences (or any data written by your application), then you will want to encrypt it. If you are that concerned about them, you're going to need to figure out exactly how much protection is necessary for the level of risk you see. There is a very extensive discussion about this in Application Security for the Android Platform, just published in December 2011 (disclaimer: I'm the author of this book).
SharedPreferences只不过是手机/data/data/文件夹中的XML文件，因此任何在root设备上具有超级用户权限的应用程序或用户都可以访问您的SharedPreferences，即使它们是使用MODE_PRIV创建的
仍然有一种方法可以保护来自每个人的...
请查看此链接。
在这里您可以将数据加密存储在 pref 中，该类是不言自明的并且非常易于使用。
正如其他
人所说，任何人都可以访问它，但在这种情况下没有人们可以读取其中的加密数据。因此它是安全的。为了最大安全性，我的建议是在运行时生成用于加密的密钥，而不是对其进行硬编码。有很多方法可以做到这一点:)
SharedPreferences are nothing but XML files in your phones /data/data/ folder,So any application or user with superuser privilages on a rooted device can access your SharedPreferences, even if they were created with MODE_PRIV
Still there is a way to protect it from everybody...
Please checkout this link.
Here you can store data in pref with encryption,the class is self explanatory and very easy to use.
https://github.com/sveinungkb/encrypted-userprefs
As said by others anyone can access it but in this case no one can read data inside it as it is encrypted. So its secure.For Utmost security my suggestion will be to generate the key used for encryption at run time rather than hard coding it. There are many ways to do that :)
通常情况下，不可以，其他应用程序无法访问它们，但是，您应该注意 SharedPreferences 以 XML 文件形式存储在
/data/data/目录中，这本质上意味着任何root设备上具有超级用户权限的em>应用程序可以访问您的SharedPreference，即使它们是使用以下命令创建的MODE_PRIVNormally, no, they cannot be accessed by other apps, however, you should note that SharedPreferences are stored as XML files in the
/data/data/directory, which essentially means that any application with superuser privileges on a rooted device can access yourSharedPreferences, even if they were created withMODE_PRIV是否可以访问共享首选项，即使它们是在 MODE_PRIV (0) 中创建的？
通过代码否。但如果您拥有超级用户权限，则可以检索应用程序文件。
是否可以列出所有可用的共享首选项，然后从其他应用程序获取所有设置？
如果您是超级用户（root 设备），那么您可以提取该应用程序的所有私有文件。
sharedpreferences 是放置密码或身份验证令牌等敏感数据的好地方吗？
不。它很容易被黑客攻击。如果您想将任何敏感数据放入共享偏好文件中，您可以加密数据并存储。您可以将加密密钥存储在 NDK/server 中。
Is it possible to get access to sharedpreferences, even if they were created in MODE_PRIV (0) ?
By code No. But you can retrieve application file if you have super user privileged.
Is it possible to list all sharedpreferences available and then fetch all settings from other apps?
If you are super user(rooted devices) then you can pull all private files of the app.
Is sharedpreferences good place to put sensitive data, such as password or auth token?
No. It can be easily hacked. If you want to put any sensitive data in shared prefrence file you can encrypt the data and store. You can store your encryption key in NDK/server.