Hacker News Reader

So the new version of Authenticator can apparently import the credentials from the old version. I don't know much about Android security, but if Google lost the signing key, would they still be able to import from the old app?

View on HN

The credentials are stored in plaintext on your phone. You can trivially extract them with a backup of your phone and a SQLite database editor.

Are these credentials all that are needed to impersonate your authenticator?

This seems "bad" - as I'd personally expect there to be no "magic" data migration path between different apps.

There should be a confirmation step from the security manager at least.

I'm familiar with the 'extract from a backup' vulnerability for any information stored on Android. However, I'm more concerned that another (non root-privileged) app can access credentials without confirmation.

I believe you'd need a rooted device for it to access another app's files, and even then you should get a popup prompting for access.

Reply on news.ycombinator.com