Best way to securely store passwords for local use?

Question

I am writing a Java application who needs three username/password pairs. I would like to add a "remember me" feature, implying I would have to store passwords on the user's computer.

Knowing this application will be used everyday by some co-workers on their own machines, I considered storing the passwords on a local encrypted file and ask for a master password who would permit to use the 3 encrypted passwords.

However, I know that password-based encryption cannot be secured if the user chooses a poor password. What could be my alternatives?

Answer 1

Aside from enforcing a password policy you could store an encryption/decryption key in the TPM. There's a library available here created by MIT. It was developed as part of the research project on Trusted Computing.

This would ofcourse not cover unauthorized access to the physical machine or if full disk encryption isn't being used.

Answer 2

Generate a string which incorporates upper case, lower case, numeric and special characters of a minimum length of 12 characters and a maximum length of 25 characters, with random truncation within the parameters described. Additionally, the string's algorithm would ideally contain a randomized pattern such that the algorithm used comes from a set of algorithms that are randomly integrated at various instances of key variables. This automatically generated password would have a one time use only, and be displayed on-screen after the computer is turned on and a user inserts a USB drive with a key on it.

The downside is that this would require an exception to autorun/autoplay for USB devices, but in the upside is that the exception rule would only work with the exact USB used to generate the login key. To mitigate the downside, use default disc encryption.

If you are required to maintain the same password for repeated use, and need a master password for the three you have configured; given that your fear is a user creating a poor password use a 'captcha' like system as a check in order to compare the user created password with the parameters you've set while simultaneously protecting from dictionary attacks against the account.