Is it ok for software to store passwords locally in plain-text?

Question

There are already plenty of questions about what to do when websites store plain-text passwords. But this one is a little different.

I use a piece of open-source (see below) software for playing games. It requires a user account that isn't directly linked to any services. Log-in consists of entering a username and a password into a dialogue, but that dialogue also provides a "Save Password" option.

This option saves the password using an API designed for storing settings in cross-platform applications. But due to the fact it's meant to save non-confidential settings that can be changed outside of the application, it saves the data in plain-text. And it does so in locations that don't require any special permissions to access. For example, on Windows the API stores the settings in the registry (in a location that even non-admins at least have read-only access too).

The API is being passed the password in plain-text and thus storing the plain-text password. This means I can run a simple command from a non-elevated prompt on my machine now and get the last password I used in plain-text.

Additionally, any software on my computer can easily access this information. I recently wrote a small program that updated certain files the software uses. However, I started getting complaints that the program couldn't edit the files even though it found them. It turned out that users hadn't been running the program as an administrator. But that means that even though my program wasn't allowed to access the program's game files, it was allowed to read the same registry keys that contain the plain-text password, even when Windows' security had blocked it as a downloaded program.

I've brought up the issue before, but despite my best efforts, no one seems to be taking this as a serious problem(see below).

Question: Am I making 'much ado about nothing', or is storing the password in plain-text locally just as serious a problem as I believe storing the password in plain-text anywhere is?

Note: It being open-source does mean I could "fix" the problem, but there are some issues:

• It's fully cross-platform (and there is no platform specific code used). Most systems I know that could store the password in a relatively secure manner are highly platform dependent (like DPAPI)

• The main development group is extremely small, and it doesn't seem any of them understands the relevance of securing the passwords. I've brought up the topic before, and the response I got makes it unlikely that a PR will get any result. The only person who runs a server using the software that I know of brushed it off as me "arguing for the sake of arguing". His response was:

"I don't know that I agree that the responsibility falls on the tool, that's like saying we shouldn't build guns cause they can be used in a bad way its up to the person using the tool to take on that responsibility"... "if some one is dumb enough to put there bank account password into [the program] maybe they should consider doing some research into security".

I then recalled seeing something about the passwords stored with encryption, so I tried to convince him that some of the same reasoning that dictates databases should encrypt passwords applied to locally stored passwords. But he disagreed (it seems the fact the passwords are encrypted at all is a little bit of cargo cult programming):

"the db is publicly accessible [I don't see why it should be that's a whole other issue], thats completely different. your machine shouldnt be sitting out in the world for people to access" ... "once again, if your machine is dangling out in the world with no protection dont come crying"

• The average user doesn't seem to understand the relevance either, so forking the repo and providing a fix won't do anything. Since the software is for a free game with no ranking or monetization, they don't understand why I'd be so concerned about someone finding out my password (or why they should be). The slightly more knowledgeable ones simply brush it off saying that it's a user's fault if their password isn't unique to that account.

• I don't agree there should be a "Save Password" function at all. Storing passwords locally is notoriously difficult to do correctly (even systems like DPAPI are far from perfect). I rarely feel that it's worth the trouble to provide the functionality. And I especially don't see the point for a program like this one.

Answer 1

Short answer, it’s never ok to store plain-text passwords and doing so is a bad practice. From your description, there is limited risk associated with the organization supporting the app because there’s no compliance or direct monetary risks attached. That risk is passed on to the users. It’s possible for the users of this software to have their passwords leaked. That poses risks to the organization in bad PR if it gets out. That could be used to justify the cost of fixing it.

Users of any software are going to expect that software is taking adequate pre-cautions with their passwords. Most users won’t give much thought to saving their passwords. They’ll assume it’s saved securely, the software won’t warn them it’s in plain-text, and most users reuse passwords. Yes, that’s a bad practice on their part but saving it in plain-text only makes things worse. The argument of ‘sheeple deserve to be hacked’ is wrong. There’s a reason home wireless routers now default to their strongest security. That was done to protect the people that don’t know how to turn it on. No one is an expert in everything and not everyone will even understand the basics of security. Part of our role as security professionals means watching out for people that don’t know enough to protect themselves.

I think you have an uphill battle for getting this fixed. I would call saving passwords in plain-text a violation of user’s trust. There’s the risk I mentioned above. However, with the attitude you’ve already seen they will probably push back on it and you continuing to push back against that culture may not be worth it for you. Even though I think it’s the right thing to do. I know that has made me unpopular when promotions/raises came around in previous jobs but I did it anyway. Users are expecting you to take precautions with their passwords. If it gets out that you don’t, you may not get that trust back.

Answer 2

I would personally disagree with the storing of plain-text passwords is ALWAYS bad, because it depends on the application or purpose of the password being stored. Generally speaking, yes, storing passwords in plain-text is a poor security choice for all of the obvious reasons. However, that doesn't mean it is a super-bad choice in all circumstances.

If the password isn't transmitted openly, (over the internet, or even the local network), is stored within the program files locally for authentication, and there isn't anything worth protecting, who cares if you store the password in plain-text? That's like password-protecting your access to notepad.exe. The ONLY risk is that the end-user will select a username and password that they use for other existing applications with a higher-risk. If that information gets compromised through no fault of your own, it is possible that your end-users could be exposed to some harm.

Heck, there are even some applications, (perhaps teaching someone how to crack poorly written applications! =D), where you might deliberately make the choice of storing plain-text passwords.

The risk is incredibly minor, and it may not even be worth worrying about. Not like you are storing passwords for access to a nation's nuclear arsenal launch codes here. But there is SOME risk, even if it is small, and taking easy steps to protect your users is just a nice thing to do.

Answer 3

The whole "unique and random" serves a double purpose in this imperfect world, where websites cannot be trusted to either do the right thing nor have good intentions.

The website could sell the username password combos to crackers for research and incorporation into advanced dictionary attacks. Aka doing intentional harm. Provide a free game, require registration, see how many dummies use the same credentials as their facebook or google accounts.

Then of course there is just the dummies that don't know anything about security and store them in plaintext.

Either way its bad and you as a user should assume that the website is untrustworthy and use a unique and random password.

And if you are a developer making a silly internet game, consider that your users could very well not know good security practices and end up using the same credentials for your game as for their bank account, and if your internet game is hacked and the password table stolen, then you could have unintentionally done great harm to your customers.

So yes I say its always important to take security seriously whether you're a developer or a user. And if you take security seriously, then no its never ok to store passwords in plaintext, nor is it acceptable to not salt them, or other antiquated bad practices.

In your particular case, you would want to encrypt the passwords based on something that only the user of your software knows rather than hashing them, because it sounds like your application is something like a password manager. There are libraries out there that make it easy depending on the technology you're using. .NET?