Is it safe to store username + passwords in a local SQLite db in Android?

Question

I\'m at the point where I can allow the user to store credentials for a simple web app in my up coming Android app. My fear (being new to Android) is that other (evil) apps

Answer 1

No... others app won't be able to get access to private data like your sqlite database. But, it's worthy to encrypt at least the passwords, just in case.

Answer 2

I have a similar situation, and found the SimpleCrypto class enough for my needs to get the passwords encrypted to avoid plain text output of passwords being easily read.

How you decide to use a key for the encryption is another question. As shown here, you could use the unique Id of the phone (obvious problems being that if they change phone you can't decrypt your data), or just simply use a random string in your code. It depends how hard you want to make recovery and how important the data is you're securing.