0

I'm developing an application that needs to store various pairs of username/password to automatically log in into third party services so that users don't have to insert them each time they open the application.

However, I'm facing the problem of storing them safely: even though they are saved on the user's hard disk (and they remain saved there except for the moment I log in to the third part application, when I send them to the server through some APIs) nothing prevents a malicious program to steal the file. I'd like the application to be open source and the location of the file will not be secret (anyway, security through obscurity does NOT seem to me a good idea, but exactly the opposite). I thought that maybe making the user insert a password and encrypt the file would solve the problem, however, I find it a bit redundant: the user must insert a password to access his computer, doesn't he?

I was wondering how programs that manage user login information (such as Mozilla Thunderbird, OneDrive, and so forth) store users' passwords safely on the HD.

Improve this question
3
  • 2
    Are you trying to create your own password manager?
    – DarkMatter
    Commented Feb 15, 2019 at 17:58
  • Work needs to be done in order to increase potential energy (physics) as well as increase security (infosec)... users unwilling to do that work are at risk of compromise... services that claim there is no pain in security are not selling actual security... The name of the game is reasonable compromise ... encrypt the password database locally using one of many tools... gpg is a good choice... or just use a password manager per @DarkMatter suggestion ........
    – RubberStamp
    Commented Feb 16, 2019 at 4:10
  • Thanks everybody for your replies. DarkMatter : What I'm trying to build is something similar to thunderbird, which can manage a lot of mail accounts. What I want to achieve is to store safely users' login information for all the mail services in the computer they set up my application. @RubberStamp I can encrypt the passwords database, but the problem of the key does not disappear, does it? I mean, the user needs to give me a password each time he access the program. So I was wondering which technique other programs (ex. Mail clients) use to store users' login information safely on thr HD
    – LuxGiammi
    Commented Feb 19, 2019 at 12:56

3 Answers 3

Reset to default
2

Increasingly operating systems and runtime environments are offering APIs to digital wallets. And there are networks let components which can be be used by enterprise systems like hashicorp and cyberark. There's lots to choose from.

When you write your own password manager you take responsibility for your users' passwords. You also potentially exclude a lot of users.

If it were me I would write an interface to get the credentials from a separate process then bundle the solution with some simple examples.

Improve this answer
1
  • That's what I am looking for: I'm not trying to write a Password Manager. I simply want to write an application that needs to manage users' login information on several websites, so what I can do is to generate a random data encryption key, encrypt the passwords file with it and then store the password in the OS digital wallet. Even though I still have some concerns (that @RubberStamp pointed out in the comments under his/her answer): at some point of time, plaintext passwords will be in memory (just before I make the call to the API that needs a password).
    – LuxGiammi
    Commented Feb 25, 2019 at 12:30
0

You have a classic security problem, easy of use vs level of security. If you want to rely on the user's password then pick an encryption key and encrypt the passwords and when you store the key set the ACLs so only that user can read the key. If you want better security and are willing to live with less ease of use then force the user to enter a password. Depending on the amount of data you can use a KDF on the password to generate the data encryption key, or if there's a lot of data that's just a key encryption key that's used to decrypt the data encryption key. My guess is you won't have enough data to justify doing the latter and you can just use the password to generate the data encryption key.

Improve this answer
-1

even though they are saved on the user's hard disk (and they remain saved there except for the moment I log in to the third part application,

when I send them to the server through some APIs) nothing prevents a malicious program to steal the file.

  • This is a bit unclear. Are you sending the password file? Or does this refer to when the user enters in a password from the file?

    1. If you are sending the entire password file somewhere on the Internet, encryption will solve your problem. Since the data do not need to be in use when in transit, they are still at rest during transit.

    2. If you are referring to a user entering in a password from the file, then the password should be protected in transit using a TLS connection... as is per standard procedure.

I mean: I'd like the application to be open source and the location of the file will not be secret

  • GPG is a good choice for application development. There is a library and an API called gpgme

I thought that maybe making the user insert a password and encrypt the file would solve the problem, however, I find it a bit redundant: the user must insert a password to access his computer, doesn't he?

  • An encrypted file remains encrypted until the moment the user enters a password to unecrypt that specific file. So, these two things are not necessarily related.

I was wondering how programs that manages user login information (such as mozilla Thunderbird, OneDrive, and so forth) store users' passwords safely on the HD.

  • Usually the password database is encrypted via some library call to the crypto primitives of whatever language the application is written in.

Source code snippet from Mozilla Thunderbird showing decryption of password database.

browser/components/migration/ChromeProfileMigrator.js:344:      let rows = await MigrationUtils.getRowsFromDBWithoutLocks(loginPath, "Chrome passwords",
browser/components/migration/ChromeProfileMigrator.js:346:        password_element, password_value, signon_realm, scheme, date_created,
browser/components/migration/ChromeProfileMigrator.js:369:            password: crypto.
browser/components/migration/ChromeProfileMigrator.js:370:                      decryptData(crypto.arrayToString(row.getResultByName("password_value")),
browser/components/migration/ChromeProfileMigrator.js:376:            passwordElement: row.getResultByName("password_element"),
Improve this answer
8
  • The entire question is about whether to separately encrypt the file. Your answer assumes that separately encrypting the file is the only answer. Can you expand on why you think this is the only way? You do not address the redundancy. The credential sets are stored in a file, and the individual credentials are sent to the individual servers by the program. The file is not being sent and users are not entering passwords themselves.
    – schroeder ♦
    Commented Feb 19, 2019 at 14:32
  • @schroeder ... Whether the passwords are entered by hand or otherwise is immaterial to the problem. At some point, the password or authentication information is an unencrypted set of data that exists in memory and is handled by the OS and application... Both answers assume that encryption is the answer to the problem of securing Data at Rest. It seemed the OP was still confused... If you prefer the other answer, perhaps this one doesn't add anything.
    – RubberStamp
    Commented Feb 19, 2019 at 15:01
  • "Are you sending the password file? Or does this refer to when the user enters in a password from the file?" I'm saying that it is neither, which invalidates that whole section to your answer.
    – schroeder ♦
    Commented Feb 19, 2019 at 15:07
  • I prefer nothing, I'm just pointing out the areas that do not make sense or where the question is not being answered.
    – schroeder ♦
    Commented Feb 19, 2019 at 15:08
  • @schroeder ... I simply like clarity. The language in the question is not necessary specific... However, you are probably correct. Assuming is sometimes dangerous though. I'm sure this is a dup question somewhere in here too
    – RubberStamp
    Commented Feb 19, 2019 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .