Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

If you have a website that need to store user's credentials for other sites, how do you store those credentials securely? An example is where you give them your username/password for your bank accounts. Based on this quora answer, uses a combination of software and specialized hardware which doesn't sound cheap or easy to build. What are some simpler pure-software solutions for storing credentials? Are there any open source software that's designed for this?

share|improve this question

marked as duplicate by symcbean, Steve, TildalWave, AJ Henderson, GdD Feb 17 '14 at 13:41

This question was marked as an exact duplicate of an existing question.

If I understand you correctly, you're asking about what broad programming method would be used. That is a question for Stackoverflow, and you should specify your programming language to keep the answer manageable. – scuzzy-delta Nov 30 '13 at 3:39

Short answer: Carefully structured reversible encryption. Long answer: The question doesn't contain enough information for anyone to provide a long answer. State the web app environment at least.

share|improve this answer

Stringent key control, regular and heavy pen-testing, and LOTS of audit logs, probably with a team to review them.

This is not a matter of "just throw it in PGP and call it a day", but requires a lot of design work. Its also a good plan to notify and work with the places you're storing passwords for, to see if you can use them once and generate read-only tokens for access, or some other form of restricted access. And follow best practices as much as possible, to prevent the breaking of one password to allow access to others.

There is also a heavy operations load - these machines need to be stripped down, hardened, and as far away from the rest of your infrastructure as you can manage, to prevent attacks from hopping over.

share|improve this answer

As per comment, I think this covers a lot of the same ground as a previous question - sorry but you really don't want to store passwords like do.

As per discussion elsewhere, there appears to be a discrepancy between what they assert and what they practice. And there's basic security stuff they still have not implemented on their site.

Please aim higher.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.