M2: 2016 - Insecure Data Storage

• OWASP Documentation

Actions by GeneXus

• The cryptographic keys are stored on the Android KeyStore.
• GeneXus allows the developer to enable/disable the application log (disabled by default). If the log is enabled (even with Debug Mode On) GeneXus does not write sensitive information on it.
• GeneXus does not expose Content Providers or Services and does not allow the developer to do it.
• The device Data Base can be encrypted.

Actions by Developers

• Use the SecureSet Method of the ClientStorage external object to persists sensitive data.
• Do not add sensitive information to the application log.
• Use the Is Password property to mask password texts.