3

I'm wondering how applications like Skype and Dropbox store access credentials securely on a user's computer. I imagine the flow for doing this would look something like this:

  1. Prompt the user for a username/password if its the first time
  2. Acquire an access token using the user provided credentials
  3. Encrypt the token using a key which is just really a complex combination of some static parameters that the desktop application can generate deterministically. For example something like:
value = encrypt(data=token, key=[os_version]+[machine_uuid]+[username]+...)
  1. Store value in the keychain on OSX or Credential Manager on Windows.
  2. Decrypt the token when the application needs it by generating the key

So two questions:

  1. Is what I described remotely close to what a typical desktop application that needs to store user access tokens long term does?
  2. How can a scheme like this be secure? Presumably, any combination of parameters we use to generate the the key can also be generated by a piece of malware on the user's computer. Do most applications just try to make this key as hard to generate as possible and keep their fingers crossed that no one guesses how it is generated?
Improve this question
2
  • I'm not an expert but,if a social engineering attack is made, it's highly probable that an attacker gets informations about the key, who is very weak cryptographically. Randomness gives more robustness, in my opinion.
    – nissim abehcera
    May 4, 2020 at 21:14
  • Hi thanks for the comment. I understand that randomness is better in general but in this case, the key needs to reconsteuctable deterministically. Otherwise, I'd have to store the key somewhere (which would be a different approach)
    – Bimba Shrestha
    May 5, 2020 at 0:29

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .