This post is regarding the Xfinity Mobile app: https://market.android.com/details?id=net.comcast.ottclient
My system log shows <userName>[email protected]</userName> and <password>MYPASSWORD</password> on a line that starts with "D/HTTPManager". I read the log using aLogcat (app available in the market). Open aLogcat, press menu and filter for "password". After I clear my log (using aLogcat) that line reappears even when I haven't used the Xfinity app. I don't use my comcast credentials in any other app.
To try and resolve this I cleared data and cache for the Xfinity app, then cleared the system log in aLogcat, and restarted the phone for good measure. I opened the Xfinity app, logged in without checking "remember me" and unfortunately my username and password immediately reappeared in the system log.
I posted this issue here: http://forums.comcast.net/t5/Mobile-Apps-and-Web/Password-revealed-in-android-system-log/td-p/872295. A Comcast employee responded to say they will investigate this issue and fix it within a few weeks. In the mean time, you may want to uninstall the Xfinity Mobile app and change your Comcast password, or at least do not share your system log with anyone (in bug reports for example) if you have Xfinity Mobile installed.
This may not be the only app that exposes sensitive information in the system log, but this is the only password I have found exposed.
I have a Motorola Droid running stock Android 2.2.
UPDATE - As squiddy20 pointed out, Comcast has updated their app to 2.0.2. They include instructions to clear the app data as part of the upgrade, but that may be unrelated to this issue. In any case, I cleared the app data and installed the update, and my credentials no longer show up in the log. As far as I can tell, they have completely resolved this issue. If the problem persists for anyone else, be sure to post that here and on the Comcast forum.
Wow Comcast.
Thanks for the heads up
I checked this out for myself and the only way I could get it to show up was by logging out and then back in. I then did a reboot, let it sit for well over 5 minutes after it was fully booted, and then tried it and still no entry under "password". I dont get any of the sporadic, random popups you seem to have gotten. Oddly though, I have it set to not login automatically, yet after the reboot, it took me right to my email messages without me actually typing in my login info. That in itself is room for concern, let alone the possibility that login info is contained in the logcat in plain text.
Samsung Moment 2.1 running TiX 1.6 rom.
Interesting I to have the same issue squiddy20. Very concerning not a good thing Comcast
I was not able to see my password
I use an EVO with 2.3 and checked the same on my logs after logging in .. and only saw my username the password was nowhere to be found. I guess it would only happen when you first try to login.
squiddy20 said:
I checked this out for myself and the only way I could get it to show up was by logging out and then back in. I then did a reboot, let it sit for well over 5 minutes after it was fully booted, and then tried it and still no entry under "password". I dont get any of the sporadic, random popups you seem to have gotten. Oddly though, I have it set to not login automatically, yet after the reboot, it took me right to my email messages without me actually typing in my login info. That in itself is room for concern, let alone the possibility that login info is contained in the logcat in plain text.
Samsung Moment 2.1 running TiX 1.6 rom.
Click to expand...
Click to collapse
Now that I have unchecked "remember me" my credentials only show up in my log when I log out and back in. Not sporadic any more.
Check your Xfinity Mobile -> Settings -> Log Out setting. If it is set to "Never", then you wouldn't have to log in again after a reboot. If it is set to "On Exit" then you should have to log in again after exiting the app or after a reboot... but that may be buggy.
Thanks for the tip, but I honestly don't access my email through the app very much. To me, less things logged into and running in the background, means more memory for other things and slightly more battery life.
Also slightly less security problems!
Well, they've updated the app and I assume they've fixed the logcat problem (haven't checked for myself yet). They do have a note: "This Update will require you to log in to the application" plus the usual updates, improvements, and fixes.
Edit: just ran 2 checks with aLogcat and can confirm that the username and password info does not show up when searching for keyword "password". On a slight side note, I've noticed that hitting the home button on my Samsung Moment exits the app, but doesn't sign out. While hitting the back button from the main screen exits the app AND signs out. Settings also seem to be staying the same, even after reboots. Mine would reset occasionally, turning notifications on and other things.
I have had some concerns as well. I have lost most of my channels in the TV listings area. It goes from 2-29 and then 75-99 but that is it. I have uninstalled and reinstalled the app several times, cleared data in applications, etc. As I reinstall the app, it is going right into my system without asking for a password which I find a bit alarming.
I assume that the program has reverted to a selection that is not the full digital programming which shows up when you first do an initial install. I cannot find a way to get back to that area to reset my configuration and add all my channels back. I have emailed Comcast and those idiots responded that they do not have an app that works with Android yet, only iPads and iPhones. Quite comical.
Any help would be greatly appreciated.
I have tried all of the methods mentioned above and when I log in using username and password, and filter alogcat only my username appears in the log. Also tried brief and long settings in alogcat preferences.
Edit: This is using the 2.0.2 version.
Hi Squiddy ,
Pressing the backbutton will exit the app and pressing the home screen actually puts the app in the background so that at later point of time we can launch the app from the page where we left .
I dont think this is an Issue.
Hi Dawgman25,
There is a settings for the program area where you can change the zipcode of yours and select the proper digital option.
After logging in tap on the settings on the lower right corner.
There will be an option program area under TV Listings.
There you can enter your zipcode and give the correct Headend (Digital) option
I think the forums.comcast.net will respond quicker and properly .
you can also directly send mail to [email protected] to get lightning response !!
I tried this and he responded immediately
There are a couple of other threads on this topic that are still unanswered for other phones, here and here.
But I see this problem on the Sensation as well, but maybe even worse:
Using a secure wifi connection with a stored personal certificate.
After rebooting, the phone will not connect to the WiFi because the check-box for "Use Secure Credentials" under the Security settings screen is unchecked.
If you don't notice this, the WiFi manager will continue to retry many times (endless loop?) failing each time, while it may be connected to 4G. This probably drains the battery since my phone was getting somewhat warm during this retry process.
You may simply go to the screen and tick the check-box, and enter your password and everything should be okay. This is annoying at least.
But if you have never set up a "Secure Credentials" password, you have to first "Clear all Credentials" than enter a new password, just to tick the check-box. This is even more annoying..
Does anyone know if this is being resolved?
Is it an Android problem generally?
Howdy!
A bit late to the party...
Using an HTC Sensation running CM7.1 alpha 10
I also have this problem. Found an app that checks "Use Secured Credentials" at boot, but that is just an ugly fix https://market.android.com/details?id=ru.chunky.AutoKeystore
I have no idea why should it be unchecked. Maybe something to do with Android/Linux and permissions? Where in the filesystem are these kind of settings saved?
I'm at a loss here. I have asked Google for their help and they were useless. I have been using a Samsung Galaxy S8+ (AT&T). It has a feature called SMART LOCK that uses a Trusted Place, which has worked in the past without any issues. For those that don't know or use it, it allows you to keep your device unlocked while your at a trusted place. With that being said, My home address keeps deleting from Google Assistant > Settings> Personal Info> Home & Work Locations. My work location stays here, but my Home Location keeps getting deleted for some reason. I can't figure out what is causing it.
I've deleted it and edited it many times and yet it still happens.I thought it was an app or allowed program, but I went through them and didn't see anything that shouldn't be allowed in my Google account. I have deleted my cache, data and uninstalled updates on all, Google Play Store, Google Assistant as well as a few others. Yet my Home Location keeps on disappearing for no apparent reason. I wouldn't care so much, but I use the Smart Lock feature while home.
I have used Tasker from the play store and set up commands and this didn't even work to unlock phone while at home.
I have wiped my phone many times and it still happens. Does anyone else have this issue or at least know a fix or is this a bug?
Any help would be much appreciated.
Sounds very frustrating. I have not heard of the issue before.
I'm wondering if you have also cleared out your Gmail address/contact info and Google calendar profile, as well?
What happens when/if you create a new alias profile? Will the alias address remain?
I would have to get back to you on that. I haven't tried creating another profile (alias). I can create another Google account and see what happens. I was also wondering if it was a fb so that could be doing it, but I have the same apps on my tablet (running marshmallow) and it doesn't get deleted from there.
Is doing it on my phone and my wife's.
I have big and annoying problem. Almost every time a touch my phone and screen is on, a prompt for turning wifi location scanning appear with options for cancel or ok. Whatever I do it appears again. If i turn wifi scanning on, it turn off after a minute. If i turn it off, then a message to turn it on appears. Ive tried to clear Google play services cache, uninstall Google play services update. It was ok for a few hours then again the prompt appear. It is the same message appear on my Huawei mediapad m5, but sometimes. Maybe because i dont go anywhere with the tablet. Maybe its something with wifi+ option, but Im using and like wifi+. I don't want to the full reset or clear cache settings, since i believe it's something go wrong with google account. Any ideas? It will be very sad if i do full reset and the problem still exists...
turn off wifi + and wifi scanning and also uninstall the google play services updates
Hello. I did that many times. On all of my devices. I don't want to turn off wifi+ because i use it a lot.
First the problem appear when my phone or tablet found some of the networks I've add before, even if i set to forget the network years ago. It's seems that Google remember all of my network I've add to the account. So. I deleted Google now cache, disabled it and enabled. Same for google service, uninstalled updates and update it again. And ive set the Google account to delete all of my history.
Second. There's a update from Huawei about this. It's not available and installed yet but i dont know did I fix the problem, or Huawei update something secretly and now problem disappear. Wifi+ works ok.
Hi everyone
i'm using two android phones which are compatible with google passkeys. I have problem with my new phone, because i don't see notifications from passkeys to authorize my login request.
Basically my older phone is fine, no matter when i log in to any website which supports webauth/passkeys, i always receive notification, i'm scanning my fingerprint and it's working great omegle xender .
I also have newer phone which i purchased like 5 months ago and there i have problem. Both phones are listed on google passkeys website and both are registered as keys to various websites. Unfortunately when i decide to authorize myself on page through new phone i don't receive any notification on my screen. The only option i have to click "Use a different Phone or tablet", scan again code and then it'll work.
After this another scan, it'll work for few minutes? i receive normally all notifications, but after like 20 minutes it break again. I've checked and notifications are enabled for google chrome.
Any ideas on how to fix that?