I am writing a (third-party) client for a game, and one feature that I would like this client to have is the ability to automatically log into the game using credentials previously entered. The credentials simply consist of an alphanumeric username and password. One naïve way of implementing this is storing a file containing the username and password on the local machine. However, this is unsafe for a number of obvious reasons. One in particular is that this client supports plugins that other developers can write. This opens up the door for a malicious developer to read the contents of the file, effectively compromising the account.
I have also considered the idea of using some cipher to encrypt (and decrypt) the password, but I was not sure what was a safe way to seed the cipher. One idea that I had was creating a randomly generated file and using that to seed the cipher and then using that cipher to access the password. However, again, a malicious plugin could simply read that randomly generated file, seed their own cipher, and then decrypt the contents of the password file.
Is there a secure way to store and retrieve a user's password on the local machine? Assume that a malicious developer has full access to the source code of the application and knows exactly what algorithms and techniques are being used.
Edit: I have no access to the server that the client connects to. My application is basically a "wrapper" for the official game client that adds extra functionality.