,
13 tweets,
5 min read
Read on Twitter
As said yesterday, they used sqlcipher which is a good thing
SQLCipher will encrypt the database. To decrypt it, you need to define a "password" and this is where the problems come
Developers: When you are using a lib, a tool or a SDK RTFM! Everything is written, you just have to read it.
The guys at @TeamZetetic, the authors of sqlcipher, published "SQLCipher Database Key Material and Selection" discuss.zetetic.net/t/sqlcipher-da…
It's crystal clear, the good practise is to take a passphrase from the user and mix it with a device id for example 
This is more than clear: "that a significant part of the key material is a secret coming directly from the user when the application runs"
"Note that hardcoding a key in application code is not suitable for any secure implementation."
This one is for you @uidai, this is exactly what you did
As said in the text, let say your device has been compromised and I managed to retrieved the local database of the mAadhaar app.
The IMEI is a 15 decimal digits. Brute forcing the password of the db will take only few seconds
The IMEI is a 15 decimal digits. Brute forcing the password of the db will take only few seconds
Interesting answer by a @TeamZetetic team member on the topic discuss.zetetic.net/t/sqlcipher-ho…
Nice article on how to hide the key of your database informit.com/articles/artic…
ffs if you want to improve your security and be a better developer, there is only one way: understand what you are using!
