Storing passwords of third party services (web app)

Question

I have a web app that includes third party websites in iframes. The 3rd party websites require user to be logged in them. Option A is to require the user to login to each website individually via iframes and rely on cookies to remember the user. That however is quite inconvenient and some users would definitely prefer a one login for all websites so that's my option B:

It relies almost entirely on frontend security and encryption.

First, storing the password. Every user has a password (main password) to my web app. The password, besides being used for logging in to my website, would also be used to encrypt user credentials from user's websites. So credentials are encrypted using the main password on my server and only the user could decrypt them. This is where I have a question, would I just need to encrypt it using the password alone, or some magic secret keys or some stuff could be used to strengthen encryption?

Overall process:

• User logs in to my web app.
• Main password is stored in browser memory for further use

• Pulling encrypted credentials from server and decrypting it on the frontend, using the main password

• decrypted credentials are stored in browser memory

• open login iframe and send credentials using postMessage to the login iframe (origin validation included)

• log in automatically (I have integration plugin for the sites, that's why I would be able to do it).

Note that logging in to web app and decrypting credentials are 2 different processes. If the user refreshes website, is still logged in, he cannot access the credentials. He will be asked for the password again. That's not a problem, since the session from third party websites will be remembered by the browser anyway.

So the frontend data would be protected from iframes by web security and as long as I make sure there are no XSS sinks on the web app, there's no way these passwords are leaking, am I right? Even if the server was compromised.

The only way I see it, if the server was compromised and someone edited the frontend code to be malicious and grab the passwords. But that is something that would always be dangerous, even if I didn't implement autologin at all.

I just want your opinion if that's a secure way to store and use passwords and what could potentially go wrong. Especially, is it safe to store passwords in javascript memory and how to encrypt credentials - use just the user password or maybe add some secret token to that password (don't know if that makes sense). Anything that would make it more secure. Any help appreciated.

Answer 1

The best way to do this would be through oAuth. Check to the documentation on the websites to see if that is a viable option. If it is not, it is definitely not recommended to store user credentials in any form on a webserver, a browser, or anything else. Normally when you validate a login you are validating that the hash (plus a salt) of the password matches what is in the database. The password is never actually stored in the database not even in a encrypted form. In this scenario there is no way for an attacker to know what the password for the user is even if they are able to compromise the database (short of a brute force attack).

Answer 2

If I understand your question correctly, you want to present yourself as a trusted middleman, who will store THEIR logins on YOUR server.

Even if this is technically possible without raising red flags and warnings all over the place, you will have hard time to convince users to essentially blindly trust you with their passwords. Because, you will handle their passwords in plaintext when logging them in. You will impersonate them. Seriously BAD idea!

So, unless there is a comprehensive legal agreement that YOU are inherently trusted to handle the passwords, I would advise against that path due to legal problems alone.

Technically, it is always a bad idea storing passwords, even if encrypted, and is even worse idea to use those passwords to log users in just for the sake of convenience.

I assume you don't have control over those other sites, because then you could perhaps establish trust in some other way, not by shuffling passwords around.