Where will you store the tokens?

For storing tokens, especially confidential ones (API access, user sessions), in an Android application, I would consider the following options:

1. SharedPreferences (encrypted or using EncryptedSharedPreferences): Suitable for small tokens. EncryptedSharedPreferences (part of Security Library) provides hardware encryption on supported devices, increasing security compared to regular SharedPreferences.

   // Creating EncryptedSharedPreferences
   val context: Context = applicationContext
   val masterKeyAlias = MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC)
   
   val sharedPreferences = EncryptedSharedPreferences.create(
       "secure_preferences",
       masterKeyAlias,
       context,
       EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
       EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
   )
   
   // Saving token
   with(sharedPreferences.edit()) {
       putString("auth_token", "your_sensitive_token")
       apply()
   }
   
   // Reading token
   val authToken = sharedPreferences.getString("auth_token", null)
   

2. Android Keystore System: The most secure way to store cryptographic keys and sensitive data. Keys are stored in a protected area of the device and cannot be extracted from the app. The Keystore system can be used for encrypting/decrypting tokens stored in SharedPreferences or a database.

   // Example of obtaining a key from Keystore (API level 23+)
   val keyStore = KeyStore.getInstance("AndroidKeyStore")
   keyStore.load(null)
   val secretKeyEntry = keyStore.getEntry("my_encryption_key_alias", null) as KeyStore.SecretKeyEntry
   val secretKey = secretKeyEntry.secretKey
   // Use secretKey for encrypting/decrypting the token
   

3. SQLite Database (encrypted tables or columns): If there are many tokens or they are related to other data, a local database can be used. For increased security, token data should be stored in encrypted columns or use a library that provides full database encryption (e.g., SQLCipher for Android).

   -- Example of creating a table with an encrypted column (implementation depends on the library)
   CREATE TABLE users (
       id INTEGER PRIMARY KEY,
       username TEXT,
       auth_token BLOB -- Storage of encrypted token
   );
   

4. Application memory (RAM): Only for temporary storage of the token during its short-term use in the current session. After the session ends or the app is closed, the token is retrieved and stored more securely. Not suitable for persistent storage.

The choice depends on:

• Token confidentiality: How sensitive is the token?
• Token size: Small tokens are easier to store in SharedPreferences or Keystore.
• Token lifetime: Is the token needed after the app is closed?
• Android version: Support for Keystore and EncryptedSharedPreferences varies.

Recommendation: Combine Keystore for storing the encryption key with encrypted SharedPreferences or an encrypted database for storing the token itself. This provides a high level of security with relatively simple implementation.