I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which typically used for .config connectionstrings encryption in ASP.NET applications)?


The most secure generally available storage option that you're going to have on Windows is is the Windows Data Protection API (widely known by the acronym DPAPI.) This is one of the options for managing the encrypted web.config file sections that you mentioned as an example.

DPAPI gives you user and machine specific encrypted storage for sensitive data, so even if the encrypted data is stolen, it can't be decrypted on another computer, and even if the attacker has access to the computer housing the encrypted data, it can't be decrypted without the correct user logging into Windows with the correct password. It isn't foolproof, but it's a fairly strong mechanism and would be what I would probably choose in this situation.

| improve this answer | |

Are you developing this software?

I would just generate a unique token stored in database such as:

  • TokenId
  • UserId (Or some entity which this token relates to.)
  • TokenKey (Which will be used as an identify to the public.)
  • IsExpired
  • Ip (Which is hashed such as SHA512 so doesn't expose the users IP if compromised.)
  • CreatedOn
  • UsedOn

Now, we need reduce the risk of token stealing.

So, let's start with IP. If the IP doesn't match the token owners then you'll want to either disallow the token thief as it doesn't match the IP of the owner. Or a more aggressive approach would be to expire the token as the computer must have been compromised to gain access to that token. You could send other information, such as a key based on hardware serials and so on, but of course this is easy to spoof.

If the token is expired, they will have to re-authenticate and get a new token.

Edit for local storing passwords:

Oops, I must of misunderstood your post. When I read your post on password tokens I thought that's what you was looking for. Encryption for a password is always a no-no. Only use encryption when you HAVE to decrypt the sensitive data. For passwords you'll want to use hashes such as SHA512. There is a lot of trade-off (size, speed etc) on hashes but there are posts out there explaining all differences.

Methods of stealing the hash:

  • Person with physical or remote access to folder could gain access to your password.
  • A network sniffer like Cain could gain passwords going through the network.

So, saving a password locally is really lowering the security of your software at the expense of user convenience.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.