Android App Security · Storing Data Safely · Lesson 5 of 5

Challenge: The Leaky Budget App

Review your cousin's budgeting app and find every place its secrets could leak.

The case brief

Your cousin is building PennyJar, a budgeting app that links to people's bank accounts through a bank-data service. Before she publishes it, she asks you to review her design. Here's what she tells you:

• PennyJar exports monthly reports, including account numbers, as files in the shared Download folder, "so they're easy to find".
• The app asks for All files access, because she read it makes saving files simpler.
• The bank-data service's secret key is typed into strings.xml. "It's fine, R8 is turned on."
• After you sign in, the app saves your session token in its settings file. She never touched the backup setting in the manifest.
• A debug line prints every server reply to the log, including the token.

She adds that PennyJar deletes everything when you uninstall it, so nothing is left behind.

The all-files request

You point out that the reports in Download aren't sealed off either. Your cousin argues that All files access is harmless, since she's only using it for her own reports.

You think about what that switch really gives an app, what it still can't reach, and how Google Play treats apps that ask for it. A budgeting app isn't a file manager, a backup app or an antivirus app.

The key in strings.xml

Next is the bank-data service's secret key. With that key, anyone could request data through her account with the service, for every PennyJar user. Your cousin says R8 makes it unreadable.

You explain that renaming code doesn't scramble the values inside it, and that the APK will be on every user's phone. The key needs to move somewhere users can never unpack, and the app should get only a short-lived token for the person who's signed in.

Tokens, backups and logs

Last, the session token. It sits in the settings file with the backup setting at its default, and the debug line prints it to the log. PennyJar targets Android 14, and many of her testers use phones from different manufacturers.

Your cousin offers to set android:allowBackup="false" and leave the debug line in, because she's heard that since Android 4.1 other apps can't read her log lines. She asks whether that covers everything, or whether there is more to fix before launch.