Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I need to save some passwords used on my app, so the user doesn't have to input them so often.

I'm trying to understand how this is done. I imagine to keep them safe they should be encrypted however my doubt is whether the user would have to input a "master password" to retrieve stored passwords which would kinda defeat the purpose of "remembering" them.

Can my app retrieve the passwords without the user needing to write a master password? How is this done?

share

migration rejected from crypto.stackexchange.com Apr 10 at 14:21

This question came from our site for software developers, mathematicians and others interested in cryptography. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as too broad by Eric G, schroeder, Stephane, raz, Xander Apr 10 at 14:21

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs. If this question can be reworded to fit the rules in the help center, please edit the question.

1  
which platform? Android? Windows? Linux/UNIX? iOS? Mac? –  SOJPM Apr 9 at 19:28
    
I'm going to migrate this to Security.SE as it is a much better fit there. That said, you should better define the environment you are working in. –  mikeazo Apr 9 at 20:16
    
You need to provide more information about your app. Are you offering to store passwords to other sites within your own app? You're starting down a difficult road if that's the case. –  Aron Foster Apr 9 at 20:20
    
Platform is really important information for this question. Some OSs' (e.g. iOS) provide native functionality for this, so knowing that would affect the answer quite a bit... –  Rоry McCune Apr 9 at 20:44
    
hi, I didn't know this had to be platform specific. We plan to develop the app for Android, iOS, Windows and OSX. It's not easy to achieve this then? –  Lisandro Vaccaro Apr 9 at 21:08

2 Answers 2

up vote 0 down vote accepted

No.

In order to store passwords in an encrypted manner, you need an encryption key. If you don't derive that key from a master password, it means you're storing the key somewhere, and an attacker can retrieve it from that "somewhere".

Now, you could store that key (or the passwords themselves) in a platform-specific secure store (such as MacOSX's "Keyring"), but there's still a master password involved, it's just system-wide rather than specific to your program.

share

Yes, you can encrypt data without a password but I'd strongly recommend against it.

You can use OS specific systems like the metioned Keyring or you can use Windows-user-account credentials to derive a key. I'm not sure about this, but this would probably give any other app potential access to your encrypted data.

You could also use keyfiles, which are a common approach for two-factor-authentification with data encryption. You could give the user a file, tell him to store it securely (for OSX/Win on an USB-Stick f.ex.?) and hope nobody will look for keyfiles. As key you'd just use the hash (maybe use a PBKDF if file may be low-entropy).

Last approach might be using the TPM to store your keys, but again I'm not sure which apps would have access to the TPM's stored keys.

share

Not the answer you're looking for? Browse other questions tagged or ask your own question.