Store github credentials

Question

I am new to the security section.

I want to write a cross-platform Java Desktop application which ask a user for their credentials and connects to their github account.What I want to do is If the credentials they provided are correct to store them in the disk.

What I would like to know is:

• Where to store their credentials
• Do I have to encrypt their credentials
• What kind of encryption do I have to do
• How do I decrypt their encrypted credentials

Also if possible I would like not to store user credentials into a database.

I would like a detailed answer with proper explanation if possible so I can learn and improve my knowledge

Answer 1

So, firstly I would avoid storing credentials for a third party at all if you can. As S.L. Barth says in the comments, look at OAuth (https://developer.github.com/guides/basics-of-authentication/) and then you don't need to know the creds - it's more secure for your users, it's less hassle for you - there's reduced liability if you are breached.

If you must store them, then yes you must encrypt. This isn't optional, you just can't store passwords in plain text and you can't hash them as they need to be reversible so you can send them to your third party. Look at the Rijndael AES suite, it is available for Java. There's a post on Stack Overflow about encryption with Rijndael. https://stackoverflow.com/questions/587357/rijndael-support-in-java

Where you store them is dependent on your application architecture, your users may have unrestricted access to your storage location on a desktop application, this is why it's critical the passwords are properly encrypted.