We are developing a password vault solution which gives a web service based API for fetching password from our vault. The API consumers will authenticate by supplying valid credentials and will request for username and password for an IPAddress. How can we ensure that our API consumers have not stored or relayed the password further ? Is there a way to copy-protect passwords ?

We are using WCF over https for exposing our web service APIs.

  • 5
    In short: You don't. – CodesInChaos Jan 11 '17 at 9:54
  • You could implement a 'use once' password feature? It all depends on what exactly you're trying to prevent here. If it's multiple use of passwords (and you're the original consumer will use it themselves at least once), that should do it. – user81147 Jan 11 '17 at 11:16
  • 1
    You don't give them the actual password. You give them something irreversibly derived from the password. – David Schwartz Jan 11 '17 at 13:12

You cannot copy protect passwords. The only thing you can do is give the passwords a very limited lifetime. After that lifetime, the password is changed and the consumer needs to request a new one.


A simple thumbrule of digital world is that what you can see , you can copy. There is no way to protect any data for that matter, Had it been possible, movie piracy would have been dead :) . I would recommend to do away with password sharing and start adopting RSA based authentication if you are into authentication brokering business. Windows is lacking in this front, but linux systems can be configured with RSA authentication pretty well. That is how amazon or azure instances are authenticated in Dev-Ops now a days.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.