9- Insecure Logging

Como se comentaba en 1- Insecure Logging , logcat no es privado y expone muchos logs

Log.d/Log.e/System.out son el problema.

Por ejemplo al loguearnos se printean las creds.

 if (DoLogin.this.result != null) {
	if (DoLogin.this.result.indexOf("Correct Credentials") != -1) {
		Log.d("Successful Login:", ", account=" + DoLogin.this.username + ":" + DoLogin.this.password);
		saveCreds(DoLogin.this.username, DoLogin.this.password);
		trackUserLogins();
		Intent pL = new Intent(DoLogin.this.getApplicationContext(), (Class<?>) PostLogin.class);
		pL.putExtra("uname", DoLogin.this.username);
		DoLogin.this.startActivity(pL);
		return;
	}
}

En ChangePassword.java se printean nombres de usuario y números de teléfono.

System.out.println("newpassword=" + this.uname);
System.out.println("phonno:" + phoneNumber);
System.out.println("Phone number Invalid.");

En DoTransfer.java se printean las transferencias:

System.out.println("Message:" + DoTransfer.this.jsonObject.getString("message") + " From:" + DoTransfer.this.from.getText().toString() + " To:" + DoTransfer.this.to.getText().toString() + " Amount:" + DoTransfer.this.amount.getText().toString());

System.out.println("Message:Failure From:" + DoTransfer.this.from.getText().toString() + " To:" + DoTransfer.this.to.getText().toString() + " Amount:" + DoTransfer.this.amount.getText().toString());

En MyBroadCastReceiver.java se vuelve a printear la contraseña y número de teléfono

System.out.println("For the changepassword - phonenumber: " + textPhoneno + " password is: " + textMessage);

Los statement en ViewStatement.java

System.out.println(fileToCheck.toString());