1

I am working on a project in wich a school's server will need to use students' passwords periodically to connect to another website for them.

I am aware that storing users' passwords in a server database is a horrible idea. Besides I can't hash them because my application needs to use the original passwords.

I wonder if I could encrypt and decrypt those passwords in the database the way password managers do. Without a chance that I (or server administrators) can read them of course.

Also, do you know of any online password manager that provides an API I could safely use on my server with PHP ? Or a password manager software that I could install on the server and use with PHP ?

8
  • 3
    Do you have any control on the remote website? The best would be to have a dedicated access to be used by this automated access. In all cases, if the server needs to be able to decipher the password in an automated way, then the server administrators (at least) will also have access to them. Commented Jun 4, 2015 at 16:46
  • 2
    Is it not possible to use OAuth or a similar system? Commented Jun 4, 2015 at 16:53
  • 2
    It's going to be difficult to recommend a solution since you're asking to break a lot of basic security principles. Why does your service need to log in as the users? Can the users not log into the 3rd party service themselves?
    – schroeder
    Commented Jun 4, 2015 at 19:48
  • 1
    @schroeder : My service will periodically connect to the remote website to check for new content and, if necessary, send an e-mail.
    – Seeven
    Commented Jun 4, 2015 at 20:56
  • 1
    Using someone's credentials to provide service for that person screams for trouble.
    – aggsol
    Commented Jun 5, 2015 at 9:43

1 Answer 1

0

Maybe you can use a kind of Vault for storing secrets. There is an Open Source project named Vault at https://vaultproject.io/. It provides a lot of options and access control. Take a look.

As others already said, this is bad practice. Authentication is made to link virtual account with physical person. That's actually breaking this.

Not the answer you're looking for? Browse other questions tagged .