Question

In my application, I store sensitive user data (like bank details) and the user can lock each of the details by using a separate password. I want the user to set a master password as soon as he runs the application for the first time after installation, so that he may recover data by entering this master password in case he forgets a password.

So, when the application is run for the first time after installation, there would be a pop-up asking him to set the master password and the user needs to set the password to continue further.

But, when the application would be started after a phone restart or maybe after closing the application, he should not get the pop-up.

The pop-up should come once and only once when the application is run for the first time after installation.

Assuming setMasterPassword() is the function which creates the dialog, where do I call this function on first run ?

Does android have any parameters to determine that the app has been newly installed ?

Or should I just use Preference Variables to check this ? {Something like initializing the counter in the PreferenceVariable as 0 and then checking this value in onCreate() and calling setMasterPassword() if and only if the counter is 0 and then incrementing the counter by 1 so that it would never be called again.}

What would be the best way to do this ?

Thanks in advance!

Answer 1

I have also tried to figure out if there is a “fresh install” boolean, but it seems there is nothing like that, so you should go for a shared preference, like the folk did here.

PS: By the way, it’s a duplicate of that question.

PS2: Keep in mind, if the user deletes all the stored information of your application, the check will also be erased and thus you’ll be able to enter this again.

How to improve your information security:

1. Store the user’s information along with some control bytes (a random number, a specific string, whatever) and encrypt this with the user’s password.
2. Anytime you need the user’s information, grab that file, try to decrypt its content with the user’s password (asked each time)
3. Check for the control bytes (a substr() will suffice, probably). If they’re the same, then grab the information. If they’re not, prompt again.

This way, you get some benefits:

• You don’t store the user’s password anywhere. SharedPreferences won’t store this, just the “firstTime” variable.
• If the user dumps the application’s information, putting again a password won’t reduce your information.
• Opening that file from an explorer will only show a bunch of numbers, symbols and probably non-readable bytes that will mostly break the editor.