I know how to store passwords for authentication of users (hash, salt, etc..), but in this case, I am developing a web app and I need to connect to other services and in order to this, I need to store username and password, so if I want to connect, I need to read the password that makes hashing useless, so I was thinking about encrypting it in the database or maybe in a protected file. Best way to store a password for web app?
Add a comment
|
1 Answer
- The best way is to NOT store the password at all
- Second way is to use a public and private secret to communicate with your service (things like oAuth and X.509 certificates)
- Third is to encrypt the data on the phone itself
The problem is that anything that's outside of your control can be possibly subjected to tampering.
Facebook, Twitter, Google and some other tech giants created the oAuth standard of which oAuth-2 would do nicely for you.
You can store a not so secure secret on the phone to secure the authentication channel than set up a secret that is only known on the phone and server and it is specific for that communication only.
To the how to do this, without knowing what platform you are using, I cannot assist there.
Ask yourself why do you need to have access credentials that anyone can use. You should consider only credentials that can easily be revoked and are specific to that connection only (so a mobile token used on the desktop yields a lockout for example).
