This post is regarding the Xfinity Mobile app: https://market.android.com/details?id=net.comcast.ottclient
My system log shows <userName>[email protected]</userName> and <password>MYPASSWORD</password> on a line that starts with "D/HTTPManager". I read the log using aLogcat (app available in the market). Open aLogcat, press menu and filter for "password". After I clear my log (using aLogcat) that line reappears even when I haven't used the Xfinity app. I don't use my comcast credentials in any other app.
To try and resolve this I cleared data and cache for the Xfinity app, then cleared the system log in aLogcat, and restarted the phone for good measure. I opened the Xfinity app, logged in without checking "remember me" and unfortunately my username and password immediately reappeared in the system log.
I posted this issue here: http://forums.comcast.net/t5/Mobile-Apps-and-Web/Password-revealed-in-android-system-log/td-p/872295. A Comcast employee responded to say they will investigate this issue and fix it within a few weeks. In the mean time, you may want to uninstall the Xfinity Mobile app and change your Comcast password, or at least do not share your system log with anyone (in bug reports for example) if you have Xfinity Mobile installed.
This may not be the only app that exposes sensitive information in the system log, but this is the only password I have found exposed.
I have a Motorola Droid running stock Android 2.2.
UPDATE - As squiddy20 pointed out, Comcast has updated their app to 2.0.2. They include instructions to clear the app data as part of the upgrade, but that may be unrelated to this issue. In any case, I cleared the app data and installed the update, and my credentials no longer show up in the log. As far as I can tell, they have completely resolved this issue. If the problem persists for anyone else, be sure to post that here and on the Comcast forum.
Wow Comcast.
Thanks for the heads up
I checked this out for myself and the only way I could get it to show up was by logging out and then back in. I then did a reboot, let it sit for well over 5 minutes after it was fully booted, and then tried it and still no entry under "password". I dont get any of the sporadic, random popups you seem to have gotten. Oddly though, I have it set to not login automatically, yet after the reboot, it took me right to my email messages without me actually typing in my login info. That in itself is room for concern, let alone the possibility that login info is contained in the logcat in plain text.
Samsung Moment 2.1 running TiX 1.6 rom.
Interesting I to have the same issue squiddy20. Very concerning not a good thing Comcast
I was not able to see my password
I use an EVO with 2.3 and checked the same on my logs after logging in .. and only saw my username the password was nowhere to be found. I guess it would only happen when you first try to login.
squiddy20 said:
I checked this out for myself and the only way I could get it to show up was by logging out and then back in. I then did a reboot, let it sit for well over 5 minutes after it was fully booted, and then tried it and still no entry under "password". I dont get any of the sporadic, random popups you seem to have gotten. Oddly though, I have it set to not login automatically, yet after the reboot, it took me right to my email messages without me actually typing in my login info. That in itself is room for concern, let alone the possibility that login info is contained in the logcat in plain text.
Samsung Moment 2.1 running TiX 1.6 rom.
Click to expand...
Click to collapse
Now that I have unchecked "remember me" my credentials only show up in my log when I log out and back in. Not sporadic any more.
Check your Xfinity Mobile -> Settings -> Log Out setting. If it is set to "Never", then you wouldn't have to log in again after a reboot. If it is set to "On Exit" then you should have to log in again after exiting the app or after a reboot... but that may be buggy.
Thanks for the tip, but I honestly don't access my email through the app very much. To me, less things logged into and running in the background, means more memory for other things and slightly more battery life.
Also slightly less security problems!
Well, they've updated the app and I assume they've fixed the logcat problem (haven't checked for myself yet). They do have a note: "This Update will require you to log in to the application" plus the usual updates, improvements, and fixes.
Edit: just ran 2 checks with aLogcat and can confirm that the username and password info does not show up when searching for keyword "password". On a slight side note, I've noticed that hitting the home button on my Samsung Moment exits the app, but doesn't sign out. While hitting the back button from the main screen exits the app AND signs out. Settings also seem to be staying the same, even after reboots. Mine would reset occasionally, turning notifications on and other things.
I have had some concerns as well. I have lost most of my channels in the TV listings area. It goes from 2-29 and then 75-99 but that is it. I have uninstalled and reinstalled the app several times, cleared data in applications, etc. As I reinstall the app, it is going right into my system without asking for a password which I find a bit alarming.
I assume that the program has reverted to a selection that is not the full digital programming which shows up when you first do an initial install. I cannot find a way to get back to that area to reset my configuration and add all my channels back. I have emailed Comcast and those idiots responded that they do not have an app that works with Android yet, only iPads and iPhones. Quite comical.
Any help would be greatly appreciated.
I have tried all of the methods mentioned above and when I log in using username and password, and filter alogcat only my username appears in the log. Also tried brief and long settings in alogcat preferences.
Edit: This is using the 2.0.2 version.
Hi Squiddy ,
Pressing the backbutton will exit the app and pressing the home screen actually puts the app in the background so that at later point of time we can launch the app from the page where we left .
I dont think this is an Issue.
Hi Dawgman25,
There is a settings for the program area where you can change the zipcode of yours and select the proper digital option.
After logging in tap on the settings on the lower right corner.
There will be an option program area under TV Listings.
There you can enter your zipcode and give the correct Headend (Digital) option
I think the forums.comcast.net will respond quicker and properly .
you can also directly send mail to [email protected] to get lightning response !!
I tried this and he responded immediately
I generally leave my wifi on at my university so as to not waste battery searching for mobile signal underground. There are a couple of misconfigured/broken APs around campus though and the phone seems to disable the network connection after there have been enough failed attempted associations.
Every time I try to re-enable the network connection, I'm asked for the Credential Storage password. Thing is, I don't have a clue what it is. I don't even remember setting one. Every time it happens, I get 4 or 5 attempts at the pw and then it resets the credential storage, forcing me to re-install the CA certificate necessary for the connection.
It feels like I've tried almost everything short of a factory reset just to figure out this password. Going to Settings -> Security -> Clear credentials doesn't work...
Does anybody know how to reset the credential storage password for the HTC One S?
same
mike12489 said:
I generally leave my wifi on at my university so as to not waste battery searching for mobile signal underground. There are a couple of misconfigured/broken APs around campus though and the phone seems to disable the network connection after there have been enough failed attempted associations.
Every time I try to re-enable the network connection, I'm asked for the Credential Storage password. Thing is, I don't have a clue what it is. I don't even remember setting one. Every time it happens, I get 4 or 5 attempts at the pw and then it resets the credential storage, forcing me to re-install the CA certificate necessary for the connection.
It feels like I've tried almost everything short of a factory reset just to figure out this password. Going to Settings -> Security -> Clear credentials doesn't work...
Does anybody know how to reset the credential storage password for the HTC One S?
Click to expand...
Click to collapse
Bumping this...
I have the same problem. If I have rebooted my phone it asks me for the credential storage password when trying to connect. And then I have to reinstall the certificates.
Im running a rooted One S with PACman ROM.
Device Administrator Settings
Go to Settings -> Device Administrators & uncheck any App that you might have selected as Device Administrator
Hello,
I am new to this form so please excuse me if i leave out some details but i own a oneplus one black 64gb running the latest ota cm11 update and one day I decided to explore a new app called "snapdragon battery guru." (it was new to me atleast) The app worked great for a week or 2 but then i noticed that my service was being messed up by the app(this isnt the issue) so i looked up some reviews and i saw many other people with the same problem so I decided to uninstall the app... (This is where the problem starts)
After uninstalling the app my phone constantly has messages on common things that i use most importantly the "disable lock screen" when on the home profiles so that i dont have to type in my password at home all the time. However, after uninstaling the app, that option in the profile settings is grayed out and says that it is "disabled by administrator, encryption policy, or credential storage"... again i looked it up on google and found that clearing my credential storage seems to be a temporary fix that last about 2 hours and then the option ends up graying out again. (which can get really really annoying because my vpns are constantly cleared out every time)
Can anyone please help me with this problem!
Thanks
Jiggy
Have you tried a factory reset? That's your best option.
Transmitted via Bacon
Settings, security, device administrator, what do you have enabled there
On stock 5.01. I have it on pin unlock right now but the options to shut it off are greyed out. The only other time I have ever seen that is whenever encryption is enabled which I do not have enabled, why can't I remove it?
xsteven77x said:
On stock 5.01. I have it on pin unlock right now but the options to shut it off are greyed out. The only other time I have ever seen that is whenever encryption is enabled which I do not have enabled, why can't I remove it?
Click to expand...
Click to collapse
Just tested on mine. I set and pin and then removed it. Do you have an app installed that set an administrator level policy on the phone? Under security-device administrators.
I believe that will also occur if you have an exchange email setup and exchange requires it.
Do you have a VPN configured?
Hmm ok. So I went through and deactivated all administraters but still "no lock screen" is greyed out.
No I do not nor have ever had an exchange account or anything other than just gmail.
As far as VPN I do not have one configured. I DO use super free VPN from the play store occassionally, but it hasn't created a noticeable VPN profile in my phone or anything. You have to run the app to even use it, and it gives you absolutely no info about what encryption tech it's using or anything else.
Just a side note, my phone is virgin 5.01 meaning it came straight from the posted ruu and wasn't upgraded from KitKat.
Just an update. Not sure what fixed it but I clicked on "clear credentials" under Security and instantly worked. Figured I would update in case someone else has the same problem!
xsteven77x said:
Just an update. Not sure what fixed it but I clicked on "clear credentials" under Security and instantly worked. Figured I would update in case someone else has the same problem!
Click to expand...
Click to collapse
That is the answer. Next time I looked it was back to the same state so it must be some sort of feature to make it hard on purpose.
Who is knowledgeable here. I can't seem to find any answers or figure this out myself.
Problem 1. Used to have P2, now have P3.... Both don't show weather on lock screen. P3 did for a brief time when I was setting it up and then it was gone. I have another phone Pixel XL on a different account and it does show weather. Phones have mostly identical software, security patches, and settings. And yes, Location History is enabled.
Problem 2. So I recently discovered that when ever I connect to my own VPN or Project Fi VPN, I get the error msg briefly "your connection was interrupted" "network charge detected", websites load after that. Clearing cache for Chrome did nothing. Went to advanced menu, flushed DNS... also nothing. The second I turn off VPN.... No more error.
No one knows well neither does Google