Password protecting my android app (the simple way)

Question

I've built my first app, and I would like to password protect it. It's fine for me to store the password in the Java files and the method needs to be as simple as possible because i have no experience of java or even xml before this app. I've had a few attempts and failed so I was hoping someone can help me out.

I've created the layout with an EditText field:

<EditText
 android:id="@+id/passwordedittext"
 android:layout_width="200dp"
 android:layout_height="50dp"
 android:inputType="textPassword"
 android:layout_marginTop="40dp"
 android:layout_marginLeft="20dp">
 <requestFocus />

and a submit button:

<Button
 android:id="@+id/submitbutton"
 android:layout_width="50dp"
 android:layout_height="50dp"
 android:layout_marginTop="40dp"
 android:background="@drawable/bgo"
 android:clickable="true" 
 android:layout_gravity="right|center_horizontal" 
 android:layout_marginRight="20dp"/>

The Java file:

package com.berry;
import android.app.Activity;
import android.content.Intent;
import android.media.MediaPlayer;
import android.os.Bundle;
import android.view.View;
import android.view.Window;
import android.view.WindowManager;
import android.widget.Button;
import android.widget.EditText;


public class password extends Activity{

MediaPlayer mpbuttonclick;


@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    requestWindowFeature(Window.FEATURE_NO_TITLE);
    getWindow().setFlags(WindowManager.LayoutParams.FLAG_FORCE_NOT_FULLSCREEN,WindowManager.LayoutParams.FLAG_FORCE_NOT_FULLSCREEN);

    setContentView(R.layout.password);

    mpbuttonclick = MediaPlayer.create(this, R.raw.keypress);

    Button sumbitButton = (Button) findViewById(R.id.submitbutton);
    sumbitButton.setOnClickListener(new View.OnClickListener() {        
        public void onClick(View v){
        EditText passwordEditText = (EditText) findViewById(R.id.passwordedittext);
                    if(passwordEditText.getText().toString()=="MyPasswordHere"){
                        startActivity(new Intent("com.berry.intro"));
                        mpbuttonclick.start();


                    }}});
    }}

nhaarman · Accepted Answer · 2012-02-19T15:40:43.350

13

This part:

if(passwordEditText.getText().toString()=="MyPasswordHere")

is incorrect. It should be

if(passwordEditText.getText().toString().equals("MyPasswordHere"))

When comparing primitive data types (like int, char, boolean) you can use ==, !=, etc.
When comparing objects (like String, Car, etc) you need to use the .equals() method.

See also this page.

edited Feb 19 '12 at 15:40

answered Feb 19 '12 at 15:15

nhaarman

98,571
55
246
278

please change `Car` to `Char` – Sambhav Khandelwal Mar 11 '22 at 14:03

score 11 · Answer 2 · edited May 23 '17 at 11:44

11

It is in no way safe to check your password like that.

There are several ways to easily bypass your code

Calling the activity directly from another App
Reading the disassembled smali code to retrieve the password
Modifying the code using smali to always jump into the codeblock

Solutions available to solve these problems:

Obscure your code (Worst option, but might be enough in most cases)
Comparing the Hashed Password: Much more secure. But should be a salted Hash. (There is also a more simple to understand explaination for the implementation)
Use a HTTP Request to a server of yours to hide the mechanism behind the password check. (But that requires your app to ask for Networking Permissions)

edited May 23 '17 at 11:44

Community

1
1

answered Feb 19 '12 at 15:48

devsnd

7,382
3
42
50

2

Hmm, as the asker is weak in java I would recommend solution two, which could be implemented like this: 'SHA1.Sha1Hash(passwordGoesHere);' – Todd Davies Feb 19 '12 at 16:25
1

Thanks for the tip, i've added a link to overcome that problem. – devsnd Feb 19 '12 at 16:37
Thanks for the advice, I will look into your solutions for when I build something more substantial. – n431m Feb 19 '12 at 17:36

score -6 · Answer 3 · edited Feb 19 '12 at 15:18

-6

In the edit text field xml you can add

   android:password="true"

edited Feb 19 '12 at 15:18

nhaarman

98,571
55
246
278

answered Feb 19 '12 at 15:16

Nitesh Khosla

875
8
20

1

Using this flag will improve your app by making the edit text have password dots instead of showing the actual characters, but this flag will not fix the problems you are having. – Todd Davies Feb 19 '12 at 16:21
The edit text box shows the dots anyway since the inputtype has been defined as textpassword in the xml. Thanks. – n431m Feb 20 '12 at 17:20

Password protecting my android app (the simple way)

3 Answers3

Linked

Related