The company I work for is building a mobile app that communicates with two APIs.
The first API is owned by us. Among other things, it manages OAuth2-style authorization and authentication.
The second API is not owned by us. It is a third party data source that only offers authorization via HTTPS Basic Auth headers. Every request to this API must include a username and password. The login credentials for the second API are different than the credentials for the first API.
We would like to store the users credentials for the second API so that the user need not re-enter their username and password every time they open our mobile app and make a request to the second API.
We've devised the following solution:
User opens our mobile app and authenticates with the first API (I am skipping the details of authentication with the first API because it is not relevant to the primary issue).
User enters their username and password for the second API.
Mobile app generates a PGP private key, public key and randomized passphrase for the private key.
The mobile app would then encrypt the username and password for the second API using the public key.
The mobile app uploads the private key, encrypted username and encrypted password to the first API. The first API stores those values on a users table.
The public key is discarded by the device. The passphrase for the private key is stored as securely as possible on the device (device keychain if available).
Any requests that were previously sent from the mobile app to the second API are now routed through the first API. The request will include the passphrase (stored only on the mobile device) so that the first API can use the private key to decrypt the username and password and send off the HTTP Basic Auth request to the second API.
In order to obtain the username and password in plain text, a hacker would need to compromise both the user's device (to get the passphrase) and our first API (to get the private key and encrypted login). Even if both the mobile device and our first API were compromised, the hacker would only get one password because each user generates their own PGP private key / passphrase combination.
This seems secure to us, but I wanted to make a post here to see if someone could point out any flaws or suggest improvements. We're curious if there's a way we can help protect against scenarios where the users mobile device is compromised. As it stands now, if the users device were compromised, the hacker would not learn the users password but they could use the private key passphrase to send off illegitimate requests and read sensitive data from the second API.