I have a user giving me a password that I need to save for automation they want to have me run. I can't use their existing credentials as it's not something Windows talks to.

And I don't want to store their password in plain text. And any encryption I do in my app (it's a desktop app) can be undone by tracing through the program.

I believe (but can't find it) that there's a way to encrypt a string and Windows encrypts it using the logged in credentials. That way the password is only readable if the user is logged in.

Is this the best way to handle this situation?

And if so, can you please point me to a page that says how to do this?

thanks - dave

  • And I found it (again). It's the ProtectedData class. But my other question remains - is this the best approach? – David Thielen Apr 13 '18 at 1:19

DPApi will apply using the current user context - so if code can execute in the same context an attacker could access the credentials. A simple powershell script run on the machine while in the same context can decrypt the contents with a single command.

Its hard to determine the best approach without knowing more about your environment.

Will the automation be running under a service account? Can you use MSA? Are certificates an option? Can you store these credentials in a secure store?

Sorry a lot more questions than answers - I would use DPApi if writting a desktop application that needs to secure data on a multi user system. Chrome for example uses this to secure cookies - I don't know if I would use it in an automated process if its running under your own user account.

  • This is for an app where users will have it run reports regularly and then email them out to their team. So most will point to their company email server and put in their email credentials. But people being people, they don't want to have to enter them each time the program starts. And this is going on desktops of people that many times are not super technical so having them install any kind of credentials store is a non-starter. I'm trying to do the best I kind taking in to account what people will actually do (as opposed to what they should do). – David Thielen Apr 13 '18 at 3:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.