android用户数据采集

Welcome to this series of articles about Android Security and how you can improve tremendously the protection of your users’ privacy, by implementing 3 things that are quick to implement.

欢迎阅读本系列有关Android安全性的文章，以及如何通过实施3个可快速实施的措施来极大地改善对用户隐私的保护。

Today we are going to look at protecting the SharedPreferences. They are usually implemented to store tiny bit of data in a persistent manner.

今天，我们将研究保护SharedPreferences 。 它们通常被实现为以持久方式存储少量数据。

First of all, you need review what is being saved in your Shared Preferences, if you’ve got anything like email address, keys, password or any sensitive/personal information, go ahead with EncryptedSharedPreferences.

首先，您需要查看共享首选项中保存的内容，如果您有电子邮件地址，密钥，密码或任何敏感/个人信息，请继续使用EncryptedSharedPreferences 。

先决条件 (Prerequisites)

You will need to target SDK 23: Android 6.0, also know as Marshmallow.

您将需要定位SDK 23： Android 6.0 (也称为棉花糖)。

minSdkVersion 23

Import the library in your build.gradle with

使用以下命令将库导入到build.gradle中

implementation "androidx.security:security-crypto:1.0.0-rc03"

EncryptedSharedPreferences如何工作？ (How EncryptedSharedPreferences works?)

ESP is using AES256 to encrypt/decrypt data on-the-fly which on a the stronger encryption algorithm that has been adopted widely in the industrie. It uses a MasterKey to proccess the data.

ESP使用AES256即时加密/解密数据，这是一种更强大的加密算法，该算法已在业界广泛采用。 它使用万能钥匙来处理数据。

ESP implements SharedPreferences interface, which provide 100% compatibility with the Android default SharedPreferences, making the implementation straight forward and allowing a smooth migration.

ESP实现了SharedPreferences接口，该接口与Android默认的SharedPreferences提供100％的兼容性，从而使实现简单明了，并允许平稳迁移。

ESP encrypts both Key and Values, which add an additional security layer. It becomes very hard to understand what’s happening in the App by looking at the SharedPreferences keys.

ESP对密钥和值进行加密，从而增加了一个额外的安全层。 通过查看SharedPreferences键，很难了解应用程序中发生了什么。

<?xml version='1.0' encoding='utf-8' standalone='yes' ?><map> <string name="__androidx_security_crypto_encrypted_prefs_key_keyset__">12a901935dc0f6ef85a...6579100118839f91b0022001</string> <string name="__androidx_security_crypto_encrypted_prefs_value_keyset__">128801fb59ba2f6d1e7a...47636d4b6579100118888ba6ae032001</string></map>

The Master Key is stored in the very secure Android Keystore, which is the most secure location of the Android OS.

主密钥存储在非常安全的Android密钥库中，这是Android操作系统中最安全的位置。

实施 (Let’s implement)

The implement is reasonably straight forward. As mentioned earlier ESP implements SharedPreferences interface, which means, you can use it just like usual SharedPreferences.

该工具相当简单。 如前所述，ESP实现了SharedPreferences接口，这意味着您可以像通常的SharedPreferences一样使用它。

However the creation of the SharedPreferences is slightly changing, as you need to provide some encryption related parameters.

但是，由于需要提供一些与加密有关的参数，因此SharedPreferences的创建稍有变化。

private val sharedPreferences by lazy { // original default implementation //context?.getSharedPreferences("default", Context.MODE_PRIVATE) // New implementation context?.let {// create the master keyval masterKeyAlias = MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC) // Create the EncryptedSharedPreferences EncryptedSharedPreferences.create( "secret_shared_prefs", masterKeyAlias, it, EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV, EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM ) }}

After that you can start using your new Encrypted SharedPreferences, just like the usual.

之后，您可以像平常一样开始使用新的Encrypted SharedPreferences。

验证加密 (Verifying the encryption)

It is always good to see that what we have implemented is working isn’t it? to see the encryption your self, head to the Device File Explorer, and navigate to your app folder:

总是很高兴看到我们已经实施的工作对吗？ 要查看自己的加密，请转到设备文件资源管理器，然后导航至您的应用程序文件夹：

/data/data/APP.NAME/shared_prefs/secret_shared_prefs.xml

/data/data/APP.NAME/shared_prefs/secret_shared_prefs.xml

Device File Explorer 设备文件资源管理器

移民(Migration)

If you’ve got an existing app, you will need to migrate your existing SharedPreferences to the EncryptedSharedPreferences.

如果您有现有的应用程序，则需要将现有的SharedPreferences迁移到EncryptedSharedPreferences。

My recommendation in this instance, is to do it either in your starting activity (MAIN, LAUNCHER) or your Application class.

在这种情况下，我的建议是在您的开始活动(MAIN，LAUNCHER)或Application类中进行操作。

The idea is to copy all data from SharedPreferences to EncryptedSharedPreferences, and then remove all legacy SharedPreferences.

这个想法是将所有数据从SharedPreferences复制到EncryptedSharedPreferences，然后删除所有旧的SharedPreferences。

From that point in time, only use ESP.

从那时起，仅使用ESP。

// Check if the new ESP has been initialisedif(sharedPreferences?.all?.isEmpty() == true) { val oldSharedPreferences = context?.getSharedPreferences("default", Context.MODE_PRIVATE) // Copy each item into the ESP oldSharedPreferences?.all?.forEach { entry ->// For each type of SP when (entry.value) { is Boolean -> sharedPreferences?.edit() ?.putBoolean(entry.key, entry.value as Boolean)?.apply() is String -> sharedPreferences?.edit() ?.putString(entry.key, entry.value as String)?.apply() is Float -> sharedPreferences?.edit()?.putFloat(entry.key, entry.value as Float) ?.apply() is Int -> sharedPreferences?.edit()?.putInt(entry.key, entry.value as Int) ?.apply() is Long -> sharedPreferences?.edit()?.putLong(entry.key, entry.value as Long) ?.apply() is Set<*> -> sharedPreferences?.edit() ?.putStringSet(entry.key, entry.value as Set<String>)?.apply() } }// TESTING PURPOSES ONLY: Verify - remove it on production oldSharedPreferences?.all?.forEach { entry ->when(entry.value) { is Boolean -> assert(entry.value == sharedPreferences?.getBoolean(entry.key, false)) is String -> assert(entry.value == sharedPreferences?.getString(entry.key, null)) is Float -> assert(entry.value == sharedPreferences?.getFloat(entry.key, 0.0f)) is Int -> assert(entry.value == sharedPreferences?.getInt(entry.key, 0)) is Long -> assert(entry.value == sharedPreferences?.getLong(entry.key, 0L)) is Set<*> -> assert(entry.value == sharedPreferences?.getStringSet(entry.key, null)) } } // delete the old unsafe Shared PreferencesoldSharedPreferences?.edit()?.clear()?.apply()}// Use the ESP from now onif(sharedPreferences.getBoolean("mykey")) { ...}

You might have to force all your user to update to this version, so in the future you can remove the migration code as well.

您可能必须强制所有用户更新到该版本，因此将来您也可以删除迁移代码。

结论 (Conclusion)

In this article we have seen how to improve SharedPreferences security with EncryptedSharedPreferences. This will help to protect your user data as well as improving general obfuscation of the app. If you are interested in Android Development, I suggest you give a try to Android Developer News.

在本文中，我们看到了如何使用EncryptedSharedPreferences改善SharedPreferences的安全性。 这将有助于保护您的用户数据，并改善应用程序的一般混淆性。 如果您对Android开发感兴趣，建议您尝试一下Android Developer News 。

翻译自: https://medium.com/swlh/protect-your-android-users-data-encryptedsharedpreferences-f423342ade24

android用户数据采集

相关资源：安卓手机基站数据采集