Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

I would like to build an open source online password vault which allows users to securely store their passwords, like Keepass or roboform, but where a user can access their passwords through a website. The idea is that you can, Login to account Create a password vault Add passwords to the vault Can grant access to the vault to other users Authorised users can view their passwords and the passwords shared with them I will obviously encrypt my passwords but I am just curious as to how I manage/store my encryption keys. I am thinking of storing the the passwords on a restricted folder on a server which is unaccessible to the public, is this a good enough method? Should I store the encryption keys as plain text?

Thanks !

share|improve this question
1  
So like an OSS LastPass? –  BrianAdkins Feb 6 '13 at 11:18
    
yes, similar to that. –  rusty009 Feb 6 '13 at 11:23
add comment

marked as duplicate by AJ Henderson, Gilles, Iszi, Ninefingers, Jeff Ferland Feb 7 '13 at 4:50

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer

For scalability, you'd pretty much have to use a database. This question is no different from any other question of how to securely store the data encryption key for a user's record and has been covered numerous times on the site. In short, there should be a key unique to either the record or user level depending on your needs. This key is then encrypted with either a public key of the user that should have access or a symmetric key derived from their password. This way, even if the entire DB was compromised, without the user's credentials (or the credentials for one of the copies of the record/user data key), it isn't possible to get at the information.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.