1

I have a web app, where users sign in with Google (OAuth 2.0). This web app uses a REST API (figo.io) in the background, so I have to create an API user with credentials.

Now I have the following problem: I have to generate a username and a password out of nowhere. The username is trivial, but the password...

Since my users log in with Google, I don't know their password, and I don't want to ask them for an additional password for the sake of a better UX. The only thing I have is their Google+ profile data.

So how do I generate this REST API password and store it safely? In their docs, the API developers state:

ONE FIGO USER PER APPLICATION USER
[...]
In this scenario it is recommend to create the figo users with a username directly mappable from your application user IDs, e.g. using [your user ID]@figo.[you application domain]. That way you do not have to save any additional information and still do not block email address of your user for explicit figo usage. Some similar, but more secure, mapping is recommended for the users password.

I can't think of a secure way to achieve this last bit about the password.

So far, the best solution I came up with is to use my users UUID (a hash), and the Google ID (from their profile, it's an int) and hash those two values into a password.

But if an attacker would hack my database, he would know the google id as well as the uuid...

Does anyone of you have a great idea? Or is "hacking my database" not a problem I should even care about? I should say, that the figo API is used for online banking, so I really want the users' data to be secure.

P.S.: Just FYI, I use a node/express server in this web app. I use passport for Google OAuth.

  • You don't need the user to have a password on your system if they are already authenticated. What would be the value of the extra password? You could allow them to register locally and if they accept they have to enter a "local" password. – NoChance Jan 24 '17 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.