title: How is Facebook Conceal secure if it just stores the key in SharedPreferences?
body: <p>I want to secure some user data that's being stored in <code>SharedPreferences</code>, so I looked to <code>Facebook Conceal</code>.</p>
  
  <p>The inherent issue with storing in <code>SharedPreferences</code> is that there are ways to access it and view the data, so naturally one would think about encrypting it so that looking at it is of no use, but if <code>Facebook Conceal</code> also stores the key in <code>SharedPreferences</code> how is it secure? It seems like viewing the data in this scenario now just requires two extra steps -- getting the key and using it to decrypt the data.</p>
  
  <p>I imagine I'm missing something here, so I'm just looking for clarification on why <code>Facebook Conceal</code> is secure if it stores the keys used to decrypt the data in the same place where the data was insecure in the first place.</p>