I'm developing an application that needs to store various pairs of username/password to automatically log in into third party services so that users don't have to insert them each time they open the application.
However, I'm facing the problem of storing them safely: even though they are saved on the user's hard disk (and they remain saved there except for the moment I log in to the third part application, when I send them to the server through some APIs) nothing prevents a malicious program to steal the file. I'd like the application to be open source and the location of the file will not be secret (anyway, security through obscurity does NOT seem to me a good idea, but exactly the opposite). I thought that maybe making the user insert a password and encrypt the file would solve the problem, however, I find it a bit redundant: the user must insert a password to access his computer, doesn't he?
I was wondering how programs that manage user login information (such as Mozilla Thunderbird, OneDrive, and so forth) store users' passwords safely on the HD.