thunderbird / thunderbird/thunderbird-android
Encrypted credentials
Nobody has claimed this yet.
- Dominant language
- Kotlin
- Stars
- 14k
- Forks
- 2.8k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 57
Description
Expected behavior
Is it possible to encrypt the account password with RSA keypair to improve the security of the used credentials? The KeyStore is protected by screen lock code, so if somebody removed the lock code, the keypair would get destroyed.
Actual behavior
Currently the account details are stored in plain text on the Android filesystem which might be vulnerable when the device is lost or compromised.
Environment
K-9 Mail version: Any
Android version: 4.3+
Account type (IMAP, POP3, WebDAV/Exchange): Any, preferably IMAP
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Start by tracing how account details are currently stored on the Android filesystem and how the Android KeyStore is used; done means defining and implementing secure credential storage for the supported account types, with key material invalidated when the screen lock is removed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- mobile, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100