Protecting Password in Code

Question

I am writing a program in Processing (which is basically java), that (amongst other things) downloads files from a FTP Server. To connect to the Server the program needs the correct FTP-password, which is currently saved as plain text in a String in the source code. The program should be given out to other people later, so I'm guessing this is not a very safe way to store the password. What would be a good way to protect the password?

Answer 1

I think your effort is broken by design. You want to install a program at someone's machine that connects to an FTP server via password, but you don't want the user to know the password. No matter what you do to protect it, the user can easily intercept the network traffic comming from the program. For example, the user could set up a proxy and just dumping everything that runs through it - the password will be somewhere in this dump. Encrypting the password at the user's side and decrypting it at the server will just delay the problem - the user will just send the encrypted password.

I would rather set up an extra FTP account with an extra directory just for this user. There he cannot hurt anything, because anything he sees is generated by his own actions.

edit It's true that with FTPS the user wouldn't be able to extract the password. But who is setting up the encrypted connection in the first place? The user's machine. So the certificate is sent to the FTP server before the encryption is done, which can be intercepted again and used to decrypt the whole communication.

Answer 2

Store the password in source code is the worst approach. But the right approach is not easy to define and depends on chosen procedures.

A better approach could be:

• Ask the user to insert the password every time (console/gui interface)
• Save the password to a text (property) file, in this case other users with right permissions could read the file with the cleartexr password. You can still encrypt the password(s) with a master password and an cipher like AES. In this case every time the user needs to insert the master password but you can protect many password with the master one at the same time.

Answer 3

What platform is this being run on?

Ideally, you should use something like an encrypted password store, or a password manager which supports APIs or command line utilities.

On linux, I use a tool called 'pass' which uses gpg encryption to store passwords.

When I want to use a password from my password store in one of my scripts, I simply send the output to a variable and assign that variable as the password.

Here's some documentation for pass:

http://liquidat.wordpress.com/2013/03/27/pass-a-perfect-shell-based-password-manager/

I also make use of Password Manager Pro from ManageEngine - they have a great SSL API for retrieving passwords. XML-RPC is also available. They provide java libraries for doing this. PMP is not free though - but it's probably one of the best password managers I've seen for the price you pay.

Answer 4

You can't.

FTP is a plain-text protocol. No matter what you do to slow down reverse-engineering the password from the program code, an attacker can always get the password just by using a network sniffer to watch what the program is sending out over the wire.

Edit: In response to your comment, FTPS is a bit harder to break: an attacker can't grab the password with a network sniffer. The password still needs to be present in RAM at some point, so the attacker can look for it with a debugger, or they can still reverse-engineer your program to extract the password.