Question

I have an app which has a user login to a webservice (username + password). I need to store the user’s username and password somewhere to auto-log them in (otherwise they have to enter username + password every time).

I have stored the username + password in SharedPreferences like so:

SharedPreferences prefs = PreferenceManager.getDefaultSharedPreferences(this);
Editor editor = prefs.edit();
editor.put("username", "the username");
editor.put("password", "the password");
editor.commit();

If I understand correctly, the actual file that shared prefs writes to is not accessible from other third party apps, correct? Therefore it’s ok to store the username + password here?

If I hook up devices to DDMS, I cannot see the shared prefs files (good). If I use the emulator, I can see them.

Thanks

Answer 1

They shouldn’t normally be accessible by other applications, but on a rooted device they can be accessed quite easily.

You may want to encrypt/decrypt the strings as your store and load them.