[Vulnerability] Bad password storing practices

[bakad3v]

I noticed that you are storing automation key in plaintext in shared preferences. It's bad practice for storing passwords. Shared preferences possibly can be read by anyone who have root access. It's a good practice to store hash instead of password, and ideally computation of password hash must be a time consuming process. There are special key derivation functions such as Argon2 created for this purpose. I implemented password hashing in this pull request. I used default parameters for Argon2, may be they must be changed.
#72

[bakad3v]

Also more complex checking for password strength required, key with length 6 is really weak. And it will be nice to add random key generation function.

[BinTianqi]

Shared preferences possibly can be read by anyone who have root access.

Anyone who have root access can also write SharedPrefs. So, in my opinion, storing hashed automation key is futile.

key with length 6 is really weak. And it will be nice to add random key generation function.

This is a good idea, I will add random key generation function. 20 bytes of automation key should be enough

[1fexd]

Anyone who have root access can also write SharedPrefs. So, in my opinion, storing hashed automation key is futile.

I think you could use the Android KeyStore

[bakad3v]

Yes, I also think using encrypted shared preferences may be a proper solution.

[BinTianqi]

As a user application, it is impossible to compete with root privilege.

So, all I have to do is prevent the key from being cracked by other user apps. I think a 20-digit key should be difficult enough to crack.