1

I am new to the security section.

I want to write a cross-platform Java Desktop application which ask a user for their credentials and connects to their github account.What I want to do is If the credentials they provided are correct to store them in the disk.

What I would like to know is:

  • Where to store their credentials
  • Do I have to encrypt their credentials
  • What kind of encryption do I have to do
  • How do I decrypt their encrypted credentials

Also if possible I would like not to store user credentials into a database.

I would like a detailed answer with proper explanation if possible so I can learn and improve my knowledge

  • 1
    This is a bad idea; why would I trust a site with my GitHub credentials? This is what OAuth is for; I'm pretty sure GitHub supports OAuth. – S.L. Barth Jan 5 '17 at 10:51
  • 1
    If "cross-platform" is restricted to Windows and Mac, and you have to store password (as others have pointed OAUTH is better) or OAUTH tokens, look at into Windows Crendential Manager and Mac Keyring (I have not found any Java interface yet). Alternatively for cross-platform support, you can use Java Keystore to store shared keys and ask user at time of application startup to provide password to unlock keystore. – jhash Jan 5 '17 at 15:05
2

So, firstly I would avoid storing credentials for a third party at all if you can. As S.L. Barth says in the comments, look at OAuth (https://developer.github.com/guides/basics-of-authentication/) and then you don't need to know the creds - it's more secure for your users, it's less hassle for you - there's reduced liability if you are breached.

If you must store them, then yes you must encrypt. This isn't optional, you just can't store passwords in plain text and you can't hash them as they need to be reversible so you can send them to your third party. Look at the Rijndael AES suite, it is available for Java. There's a post on Stack Overflow about encryption with Rijndael. https://stackoverflow.com/questions/587357/rijndael-support-in-java

Where you store them is dependent on your application architecture, your users may have unrestricted access to your storage location on a desktop application, this is why it's critical the passwords are properly encrypted.

  • 2
    If the users have unrestricted access to the storage location, they might also have access to the key used to encrypt the passwords... OP really should go with OAuth. – S.L. Barth Jan 5 '17 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.