WSJ: Netflix Android App Stores Username & Password Unencrypted

The WSJ Journal reports that the Netflix app on Android stores the username and password unencrypted on the phone.

The Android applications of LinkedIn, Netflix and Foursquare stored user names and passwords in unencrypted form on their Google-powered devices.

Storing that data in plain text violates a commonly accepted best practice in computer security. Since many people tend to use the same usernames and passwords across any number of sites, the failing could help hackers penetrate other accounts.

For someone to be able to steal the data would require access to the phone or for the user to install "malicious" software.

A Netflix spokesman said the company was aware of the vulnerability and is making a change in the app that will also secure the usernames and passwords. Netflix wouldn’t specify a date for the change but the company said it is a priority.

Comments

[gir]

I've recently begun updating all my registrations to use unique (and strong) passwords.

Of course the only way that's practical is to use a password manager. That's easy on a PC, but does Android have a password manager (or is there an app for that)?

[Tester recommends OI Safe: https://market.android.com/details?id=org.openintents.safe&feature=search_result].

[Kinbalk]

@Gir

LastPass has an android app. I believe it's a dollar a month though cause you need the Premium Version to connect.

[Tim]

Android has a fantastic auth system. The problem is that it's somewhat complex and difficult to find documentation. Google should probably take this as a sign that they need to provide some new fantastic tutorials on how to do it.

[Andrew Beck]

KeePass has an android app. I use KeePass on the desktop and on android, and then keep my password file on dropbox. That way I can always be sync'd.

[Marcus]

This might actually bother me if a Netflix app existed for my Galaxy S Android phone. :)