3. Password stored as plain text in the "accounts.db" file

Password stored as plain text in the "accounts.db" file

  • A

    In the database found under "/data/system/users/0/accounts.db" the owncloud password is stored as plain text.
    This means anyone with root access on the phone, probablly including closed source apps that need root, can aquire the password.
    This might lead to the discussion that a rooted phone is always a risk, however it would still be nice to add an additional layer of security here.

    0
  • R
    developer

    Thanks for your suggestion, but this is intended Android design. DAVdroid uses the Android account management and password methods. Additional security would have to be implemented in this API.

    0
enhancement 169