how to use AES256 instead of AES 128 about secure-preferences

[scottyab]

Thanks for your/security teams comments... that list sound more of a generic check list rather than specific to this lib? (i may of misunderstood)

I felt generally 128 is as strong enough it's just generally people tend to 'require' maybe without understanding the differences/benefits, here's a good blog about it. Of course this and the core are an open source lib please do fork and PR change to AES 256 if you'd like.

That said rather than store the user password if you can request off the user each time the app is opened and use this constructor the user password this is never stored.

The shared prefers are not stored on SDcard (this is an Android thing not something this lib does) additionally using via this lib can only be opened context private.

You can implement ProGuard or ideally something stronger like DexGuard's class encryption.

The if you use the password described above the key is derived from the password, if not then yes, yeah each key is derived per device.

Thank you very much for your reply :)