Secure storages in an Android app

Issue

My questions is very short and simple:

Is it possible for anyone or anything (e.g. an app with root capabilities or a computer debugging a phone) outside my app read the values saved in:

1. R.android (mainly strings saved in strings.xml)?
2. something.java (e.g. a boolean or a private static final String)?

If yes on both, is there any good alternative in order to save "secret" information like encryption keys etc?

Thanks

EDIT: I use encrypted-userprefs by sveinungkb (https://github.com/sveinungkb/encrypted-userprefs) but want to save the key to the storage somewhere.

Solution

R.android (mainly strings saved in strings.xml)?

That is all publicly accessible, by any app.

something.java (e.g. a boolean or a private static final String)?

Assuming that you do not expose that data yourself, apps cannot access it. Users can, by pulling your app off the device, and decompiling it.

is there any good alternative in order to save "secret" information like encryption keys etc?

Passphrases belong in the user's head.

You are welcome to invest in advanced obfuscation tools (e.g., DexGuard) if you wish. Those won't stop a determined attacker, but they might deter attackers from bothering.

I use encrypted-userprefs by sveinungkb

Such a library is designed to defend the user's data against attackers, using a passphrase known to the user.

Answered By - CommonsWare