0

I am writing a server-client program. When a new user installs the program and opens it for the first time, he has to enter a password. The password in combination with an email address is needed to authenticate to the server via SSLSocket.

I know how to save a password securely (store salt and hashed password), but how can I create a secure system, where the client automatically sends the password to the server? I do not want the user to type the same password every time he wants to login.

Is it possible to create a secure system like this? Because if I save the hashed and salted password in a .txt I can just read it and then login to the server? How is it possible to create something like this?

EDIT: My client opens an ssl socket to a server.

(1) Is it safe to send the plain password via SSL after opening the connection successfully? Or would you send the hashed and salted pw?

(2) Is it possible to store the password (either plain or hased) on client side?

I want the program to automatically send the pw hash to the server when it starts but it mudt be secure.

12
  • You are salting and hashing the password client-side? – schroeder Mar 27 '20 at 18:42
  • I'm not an expert on security, but what I do in this scenario is get the machine's serial number and use that as a key to encrypt/unencrypt the locally stored password. I send the username/password for each request... (always https) I'm not real happy with this approach to be honest, so I'm eager to hear some better solutions. – pcalkins Mar 27 '20 at 19:14
  • Well the hashed pw and salt are stored on the server, but I don't know in which form I should save the pw on client side...never save a pw in plain text so I guess also hashed? But then somebody could just read the file and send the hash to the server. I honestly have a little brain twist at the moment. – F_Schmidt Mar 27 '20 at 19:18
  • 1
  • 1
    I suggest to look up OpenID connect. You can set up your own authz server and then use something called as offline access tokens (and store the tokens on client side in a "securely" e.g. by restricting file permissions). – bhorkarg Mar 28 '20 at 12:36
1

There are many many ways to do login mechanisms, and it's a pretty complex topic. This is too broad a question for me to give you a full answer, so just some pointers.


Mandatory "don't roll your own" warning:

If you are building this app for your own learning, then carry on good sir! But if you are building this for a real website, then please find a web framework (like springboot/springsecurity) that has implemented all the login and session management for you, because there is a lot that you can get wrong.


Normally when the user logs in (ie sends the server their username / password) the server returns some sort of session token, some sort of authentication token (which may double as a session token), and sometimes also a refresh token to get a new auth token once it expires. These can take many many many forms, but common options are cookies, JWT, and bearer tokens, and each has security landmines that you need to read about and make sure you don't do.

The important thing is that every time the client sends a request (GET or POST) to the server, this authentication/session token is attached to it to tell the server which user and session this request should be part of.

If you want users to stay logged in across restarts of the client, you can save the auth / session / refresh token to disk, and use that to resume the previous session.

The details of this are a bit too complex for a StackExchange answer, but hopefully points you in the right direction, and gives you some keywords to google.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.