Shouldn't Android AccountManager Store OAuth Tokens on a Per-App/UID Basis?

TL;DR

[Michael (top answer)] Is this a valid/practical security concern? For the official Client A, my OAuth2 provider may issue a "super" type/scope token which grants access to both public and private pieces of my API In the general case, you could never rely on an auth token given to a user remaining secret from that user. For example - the user could be running a rooted phone, and read off the token, gaining access to your private API.

When to use

You are seeing this: [Michael (top answer)] Is this a valid/practical security concern? Use this skill when you run into "Shouldn't Android AccountManager Store OAuth Tokens on a Per-App/UID Basis?".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

[Michael (top answer)] Is this a valid/practical security concern? For the official Client A, my OAuth2 provider may issue a "super" type/scope token which grants access to both public and private pieces of my API In the general case, you could never rely on an auth token given to a user remaining secret from that user. For example - the user could be running a rooted phone, and read off the token, gaining access to your private API. Ditto if the user's system was compromised (the attacker could read off the token in this case). Put another way, there's no such thing as a "private" API that is at the same time accessible to any authenticated user, so it's reasonable for Android to ignore this security by obscurity goal in its design. a malicious app ...

Context: Stack Overflow #14437096 (top answer, 10 votes, 4 answers): Android's AccountManager appears to fetch the same cached auth token for apps with different UIDs - is this secure? It does not seem compatible with OAuth2, since access tokens are not supposed to be shared between different clients. Background/Context I am building an Android app which uses OAuth2 for authentication/authorization of REST API requests to my server, which is an OAuth2 provider. Since the app is the "official" app (as opposed to a 3rd-party app), it is considered a trusted OAuth2 client, so I am using the resource owner password flow for obtaining an OAuth2 token - the user (th

Source: Stack Overflow #14437096 (top answer, 10 votes, 4 answers): Android's AccountManager appears to fetch the same cached auth token for apps with different UIDs - is this secure? It does not seem compatible with OAuth2, since access tokens are not supposed to be shared between different clients. Background/Context I am building an Android app which uses OAuth2 for authentication/authorization of REST API requests to my server, which is an OAuth2 provider. Since the app is the "official" app (as opposed to a 3rd-party app), it is considered a trusted OAuth2 client, so I am using the resource owner password flow for obtaining an OAuth2 token - the user (th

Verified resolution: [Michael (top answer)] Is this a valid/practical security concern? For the official Client A, my OAuth2 provider may issue a "super" type/scope token which grants access to both public and private pieces of my API In the general case, you could never rely on an auth token given to a user remaining secret from that user. For example - the user could be running a rooted phone, and read off the token, gaining access to your private API. Ditto if the user's system was compromised (the attacker could read off the token in this case). Put another way, there's no such thing as a "private" API that is at the same time accessible to any authenticated user, so it's reasonable for Android to ignore this security by obscurity goal in its design. a malicious app ...

Source URL: https://stackoverflow.com/questions/14437096