Generally you can't stop a determined or experienced hacker. My suggestion is not to worry too much because unless you have a lot of users (or money) it is unlikely anyone is going to put any serious effort towards hacking your application; Concentrate on delivering a fantastic piece of software.
However you can:
Avoid storing passwords as string literals
- This should be obvious.
Obscure your passphrases
- Use a collection of plain english words or random characters to buffer your passphrase to possibly confuse the hacker or to make the passwords less obvious.
Obscure symbol names
- There is a possibility a hacker could extract obvious symbol names from your binary. For example,
class keyChain. You can mislead while maintaining readability by using
#define keyChain readModule.
Obscure application flow
- Say the hacker works backwards from the file decryption to find the passphrase, you could use function pointers to obscure the appeared application flow.
Generate your passphrase at runtime
- You write your own function that generates and spits out your passphrase during runtime.
Encrypt / Decrypt passphrase with your own function
- If you use another third party library an attacker can look for common calls. Obviously be smart with this and don't use some form of the
caesar cipher, and remember to only use this to hide your passphrase, that is, still use
OpenSSL for your actual data encryption and decryption. However this will lead you back to the start of safely storing a password. The gain is in the attempt to prevent the hacker from searching common decryption/encryption function calls.
Regardless, none of these will completely stop a hacker. They may slow down or prevent a novice, or they may do absolutely nothing.
Work on making your software that great that bypassing it straight to decryption is unattractive. Convince users that your software is worth using.