Is there an equivalent to iOS's Keychain for user credentials on Android?

小开

Short answer, there isn't one. But you can expect the filesystem to be secure.

Each app operates under a different user, and the filesystem used to store app data is secured by normal UNIX user permissions. So each app's file access is sandboxed by default. The filesystem also may be encrypted.

This page from the developer's site explains it better: http://developer.android.com/guide/topics/security/security.html

小开

http://developer.android.com/reference/android/security/KeyChain.html

Keychain for OS 4.0

小开

Expanding upon @DJPlayer's answer:

Some relevant articles. The third includes a github app that demonstrates using the keystore provider to generate keys and then encrypt strings.

Also see Android Storage Options for ways to store the encrypted password - my recommendation is Shared Preferences.

Note that according to the second article with root access and a bit of knowledge of how your app uses the keystore (which might be obtainable from decompiling your apk), it's possible to hijack the private key and use it to decrypt encrypted material (ex: the persisted password)

小开

Actually there is:

By integrating Smart Lock for Passwords into your Android app, you can automatically sign users in to your app using the credentials they have saved. Users can save both username-password credentials and federated identity provider credentials.

Integrate Smart Lock for Passwords into your app by using the Credentials API to retrieve saved credentials on sign-in. Use successfully retrieved credentials to sign the user in, or use the Credentials API to rapidly on-board new users by partially completing your app's sign in or sign up form. Prompt users after sign-in or sign-up to store their credentials for future automatic authentication.

https://developers.google.com/identity/smartlock-passwords/android/