Android account passwords are stored on disk in plain text
Cleartext passwords are perfectly fine in this case. I speak as a software engineer specialized in security.<p>This bug report was filed by someone who doesn't understand that <i>obfuscating</i> a password is different from <i>encrypting</i> it. No matter how you store it, the application must be able to extract a cleartext password from whatever storage options are available on the Android device.<p>For a longer explanation: <a href="http://developer.pidgin.im/wiki/PlainTextPasswords" rel="nofollow">http://developer.pidgin.im/wiki/PlainTextPasswords</a><p>That said, one defense-in-depth mechanism that I would like to see on portable devices like phones would be to have an encrypted storage area that is only accessible after typing a passphrase at boot time (the key derived from this passphrase should be stored in volatile memory only). That way if the device is shut down, this secure area would <i>not</i> be decryptable.<p>Edit: I am defending the mail <i>application</i> because from its viewpoint it is fine to use cleartext passwords. On the other hand the <i>OS</i> should provide a secure storage area as described in my previous paragraph.