3

I'm somewhat new to data encryption/safety, but I already read about basic concepts like hashing passwords, encrypting files, etc. If possible, please ELI5 - thanks in advance.

Background: my application interacts with a third party (Twitch) using an OAuth key for IRC as well as a Client ID. Both of these can be used to effectively access the application's Twitch account and do anything with it. The keys are sent as plaintext whenever the application establishes a connection with the Twitch servers (which I can't do anything about and it's not really that huge of a problem). My main security concern is about someone getting access to the user's computer and stealing the keys from there.

I'd like to securely store these on the disk so that the user doesn't have to log into Twitch every time they open the application (to retrieve the keys). To do this, my best solution so far was to encrypt the file containing them. The obvious way to do this would be to require a password when the application starts, then use a stored hash+salt to check that password, and use the password (or its hash with a different salt) as a key to decrypt the file.

As said before, I'm new to data protection, so there might be a much better way to do this. Please do suggest one if there is one. However, as for this...

If possible, I'd also like to not have the user enter their password every time they open the application - simply for user convenience. Prompting the password once per user session (or once every time the computer is restarted) seems reasonable.

I thought about doing this by storing something in RAM, or perhaps by storing some kind of hash as a temporary file. However, I haven't been able to come to an actual conclusion yet. Maybe I'm asking for too much. Nevertheless, is there an actual, decent way to implement this? If not, is prompting for a password on every application startup a better idea than going about storing those Twitch keys securely in some other way?

If it matters - for my specific case, I'm using Python 3.7, and I aim to make my application cross-platform (as long as the system supports Python).

Improve this question
2
  • Twitch supports OpenID, and the dev page have helpful sample code. You should start there.
    – ThoriumBR
    Nov 30, 2018 at 0:18
  • @ThoriumBR: OIDC isn't openid, it's oauth with features borrowed from openid. And even if you use it, you still have to store a cookie/token.
    – user1686
    Nov 30, 2018 at 10:24

1 Answer 1

Reset to default
1

If you want it to be cross-platform, consider using a Python module which provides access to various platforms' existing built-in "keyring" systems. A popular one is called python-keyring.

In all platforms which have a keyring, it is stored encrypted with the user's login password and unlocked in RAM while the user is logged in.

(This isn't super-secure, as technically other programs can also request the same password from the OS... but practically all other "store something in RAM" options would have the same problem, so it's not a downgrade.)

Improve this answer
2
  • I actually had no idea that Windows had its own implementation of keyrings - that's what I was actually thinking about before asking this question, I guess I should've researched more. This solution works fine for my case... Thanks for the answer!
    – selplacei
    Nov 30, 2018 at 10:08
  • Yes – although the python-keyring page implies it's something UWP-specific, but in reality it uses the same 'credential' API that has existed since Windows XP. (I checked, it imports win32cred from PyWin32.)
    – user1686
    Nov 30, 2018 at 10:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .