Safe ways to store passwords without hashing them

Question

I'm working on an email client for Windows, and to send emails, my application needs to have the email address and the password of that email address. When the user gives his password, I store it encrypted. When sending an email, I pass the decrypted password. But there is one problem here: if I just encrypt a password, someone can easily decrypt the password if they have the key and this key is easy to get when decompling my application and finding the key. But I also can't hash the password because I need to pass the password in plain text and I don't want to annoy my users by asking the password every time they start my application.

So how can I store the password safely without hashing it?

Note: I have read this question: Keeping a user's passwords, but can't hash them , but that's for a web application and I have a desktop application so I can't use a server.

Answer 1

If you're talking about a Windows desktop application, you should use the CryptProtectData API, which stores the credentials in protected memory regions and encrypts them with a key that is part of the user profile. This is the standard protection mechanism for Windows applications.

On Linux you could look into using the GNOME keyring or KDE wallet, and OS X has a set of APIs for its keyring too. This would ensure that the security settings for the user's keyring take overriding control - they can decide how often they want to have to re-enter their master key.

Any procedure you choose to obfuscate passwords is an exercise in futility against any half-determined attacker, so at most you're creating an illusion of security. My suggestion is to include a setting that says "remember my password", but warn your users that the password will be stored locally in a reversible format that offers little security, so that they're aware of the issue.