5

I'm writing a piece of software which will have to store a users password to allow authentication with a 3rd Party service. Unfortunately, this service currently requires the use of a password rather than some other method. A key feature/advantage of this software will be the elimination of a sign-in prompt (after the first authentication), and so it's imperative that we store the password.

I intend to use the .NET ProtectedData class for this operation.

I'm essentially asking - is this acceptable in 2015? Is there a better and more secure method of storing this data?

Further detail as requested: The software is client side, designed to run in the users context on Windows desktops. These machines are generally going to be "managed" machines (I.e., under the control of an IT department), but I'm building on the presumption that this software could be installed on any client, by any user.

Therefore, I essentially need to presume that at any point a machine could be lost/stolen. That said, if a users account is compromised then that's already more damaging than a potential compromise of this password.

2
  • 3
    @RobertHarvey I ask simply because security is a constantly moving goalpost and (in this sense) it's not something I have to touch particularly often
    – Dan
    Mar 25, 2015 at 16:00
  • Thanks guys - I've updated in response to your questions but I'll flag this for migration as it seems to fit better over there.
    – Dan
    Mar 25, 2015 at 16:31

1 Answer 1

4

Yes, this is one of use cases that Protected Data (and the underlying DPAPI) was expressly designed for, and is generally probably the best mechanisms at your disposal.

One thing I'd add is that it's best to set the DataProtectionScope to CurrentUser, which will offer stronger protection, because the data isn't available to other users and processes on the machine as when the scope is set to LocalMachine.

1
  • That'll do for me, thank you. And thanks for the CurrentUser tip.
    – Dan
    Mar 25, 2015 at 19:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .