[android-security-discuss] Re: Protecting Data in Android 2.x devices

2011-09-26 Thread David Herges
On Monday, 26 September 2011 06:10:47 UTC+2, Ryan Mattison wrote: Store it on a server. That can't be the solution. Then you can also go and use the javax.crypto.* libraries to implement data encryption at app layer -- You received this message because you are subscribed to the Google

[android-security-discuss] Security of a factory reset?

2011-09-26 Thread newbie
Can anyone tell me what exactly goes on when one does a factory reset? Does this simply format the data partition on the phone or does it actually overwrite the partition/zero it out to securely erase it? Thanks -- You received this message because you are subscribed to the Google Groups

Re: [android-security-discuss] Re: Protecting Data in Android 2.x devices

2011-09-26 Thread Subbu Srinivasan
Yes-You should be able to store on the card, provided you follow good security guidelines like proper key type, length, where u store the key etc. On Sun, Sep 25, 2011 at 9:10 PM, Ryan Mattison rmattis...@gmail.com wrote: Store it on a server. On Sep 25, 1:27 am, perumal316

Re: [android-security-discuss] Re: Protecting Data in Android 2.x devices

2011-09-26 Thread Guilherme Vieira
The local SQLLite is safe, isn't ? On Mon, Sep 26, 2011 at 11:27, Subbu Srinivasan ssriniva...@gmail.comwrote: Yes-You should be able to store on the card, provided you follow good security guidelines like proper key type, length, where u store the key etc. On Sun, Sep 25, 2011 at 9:10

[android-security-discuss] Re: Protecting Data in Android 2.x devices

2011-09-26 Thread perumal316
Hi All, Thanks for all your suggestions, I am looking more at lost and stolen scenarios where the device is lost and data stored within the device can be accessed. One way I am trying is using encryption library like spongycastle/ bouncycastle to encrypt all data that will stored within the

Re: [android-security-discuss] Re: Protecting Data in Android 2.x devices

2011-09-26 Thread Guilherme Vieira
Here we go: http://developer.android.com/guide/topics/data/data-storage.html#db Android provides full support for SQLite http://www.sqlite.org/ databases. Any databases you create will be accessible by name to any class in the application, but not outside the application. On Mon, Sep 26, 2011

Re: [android-security-discuss] Re: Protecting Data in Android 2.x devices

2011-09-26 Thread James Burns
Do you have a link to that claim (or source code)? The work that Apple did to make this happen in iOS 5 seemed non-trivial. On Mon, Sep 26, 2011 at 12:37, Guilherme Vieira guira...@gmail.com wrote: Acording to Android API, the local SQL database can be configured to be accessed / available only

Re: [android-security-discuss] Re: Protecting Data in Android 2.x devices

2011-09-26 Thread Quentin Lefebvre
Hi, Indeed, you can convert any data to byte arrays. You should then use the method(s) Cipher.doFinal(...) to perform encryption, as well as decryption operations. Best, Quentin On 26/09/2011 19:44, perumal316 wrote : How do I encrypt files like pictures or videos? I have only tried

[android-security-discuss] Re: Protecting Data in Android 2.x devices

2011-09-26 Thread Ryan Mattison
Hey Peruma, I don't know much about encryption, but it seems like AES128 would be a simpler option for you. Thanks, Ryan On Sep 26, 12:44 pm, perumal316 perumal...@gmail.com wrote: Hi All, Thanks for all your suggestions, I am looking more at lost and stolen scenarios where the device is

Re: [android-security-discuss] Re: Protecting Data in Android 2.x devices

2011-09-26 Thread James Burns
This is not the same as data at rest encryption but rather relies on the Android (Linux) OS access control restrictions. accessed / available only by the main user login information implies that the user credentials are somehow being used to protect that data, which is why I asked. Your statement

Re: [android-security-discuss] Re: Protecting Data in Android 2.x devices

2011-09-26 Thread Chris Palmer
On Mon, Sep 26, 2011 at 1:53 PM, James Burns jfbu...@gmail.com wrote: This is not the same as data at rest encryption but rather relies on the Android (Linux) OS access control restrictions. accessed / available only by the main user login information implies that the user credentials are

Re: [android-security-discuss] Re: Protecting Data in Android 2.x devices

2011-09-26 Thread Kevin Chadwick
On Mon, 26 Sep 2011 10:45:07 -0700 Subbu Srinivasan wrote: Forget Android security. Today in server - foolishly people assume firewalls, DB cannot be hacked etc. But this is a fallacy. There are ancient OpenBSD firewalls (non-ipv6) still running without any known remote exploits. I guess