Repository navigation
Credentials are stored and transmitted in clear text #16
Description
- Storage: camera URLs, including
user:password, are stored in plain-textSharedPreferences. - RTSP: the app only supports plain RTSP with Basic auth (base64), so the password is readable by anyone on the network path.
- WebUI: HTTP Basic is sent in clear text as well.
usesCleartextTrafficis enabled.
Proposal: Digest auth (#8), RTSPS support, and storing passwords through the Android Keystore.
Activity
docs: rewrite README, add Russian and Chinese translations
feat: store camera URLs encrypted with an Android Keystore key
feat: store camera URLs encrypted with an Android Keystore key
Merge pull request #54 from OpenIPC/feat/credential-store
compot-dev commentedon Oct 12, 2026
Partially done in #54: on Android 6.0+ camera URLs are stored encrypted (Android Keystore, AES-GCM,
enc1:), and existing values are migrated on first start. Still open: Android 5.x and Keystore failures fall back to plain text, and the transport (RTSP/HTTP) is unencrypted. RTSPS is not supported yet.compot-dev commentedon Oct 12, 2026
Closing; the final state is documented in the README security notes (#57).
allowBackup="false"), so reading them needs root or physical access. Refusing to save on such devices would make the app unusable there, so this is accepted.user=…_password=…) travel with every request. Use the app on trusted networks.docs: rewrite README, add Russian and Chinese translations
feat: store camera URLs encrypted with an Android Keystore key
Merge pull request #54 from OpenIPC/feat/credential-store
docs: security notes reflect the final state of #16