I'm trying to build a web application that can store passwords of other services like Facebook, Gmail ...etc.
These passwords can be later retrieved and shown to the user. This has to be a web application and has to work with modern browsers. The application cannot have the concept of a master password that can be inputted by the user. It HAS to work without any input from the user. So locally encrypting and decrypting on the device with the master password may not be a option like how the below services do it.
Is there a secure way to do that with encryption like AES. If the server is compromised for example is there a way to protect the keys?
EDIT: In the app the user does have authentication. So the user can login and then input his credentials to other platforms. But that master password cannot be used to encrypt the keys because in the system the user can share the password with other users of this choice. In that case the other user can see the password without the master password. Hope it makes the requirement clear