If you have a website that need to store user's credentials for other sites, how do you store those credentials securely? An example is Mint.com where you give them your username/password for your bank accounts. Based on this quora answer, Mint.com uses a combination of software and specialized hardware which doesn't sound cheap or easy to build. What are some simpler pure-software solutions for storing credentials? Are there any open source software that's designed for this?
Stringent key control, regular and heavy pen-testing, and LOTS of audit logs, probably with a team to review them.
This is not a matter of "just throw it in PGP and call it a day", but requires a lot of design work. Its also a good plan to notify and work with the places you're storing passwords for, to see if you can use them once and generate read-only tokens for access, or some other form of restricted access. And follow best practices as much as possible, to prevent the breaking of one password to allow access to others.
There is also a heavy operations load - these machines need to be stripped down, hardened, and as far away from the rest of your infrastructure as you can manage, to prevent attacks from hopping over.
As per comment, I think this covers a lot of the same ground as a previous question - sorry but you really don't want to store passwords like mint.com do.
As per discussion elsewhere, there appears to be a discrepancy between what they assert and what they practice. And there's basic security stuff they still have not implemented on their site.
Please aim higher.