I need to use an external service that can only be accessed by password.
I don't like the idea of storing the plaintext password on the server, but AFAIK there's not much I can do.
Considering this service will only be accessed by a client (that also can't know the whole password), my idea to try to make things a bit harder for a hacker, is to store "half" of the key on the server, and "half" of the key on the client.
I know this also can't be perfect, and that someone who gets full access to the server will be able to find out the password, but it's better than nothing. (Other suggestions are welcomed.)
Considering the password changes from time to time, and that I don't want to change the "server half" of this password, my best idea so far is this:
- Generate a random key K and store it on the server
- Encrypt password (P) with K, generating E, and give E to the client
- Now, everytime the client wants to access the service, it provides E and the server will decrypt E using K.
- When the password (P) changes (to P'), I just need to encrypt it with K again and provide the new E' to the client.
Does this seems reasonable? Any other ideas?