Question

I have a curl script which logs into a website that I wrote in PHP to accomplish a task.

The problem is I have to store my password in plain text in a PHP file as so curl can use it to login correctly.

Is there any way I could encrypt that password, so if anyone else ever got onto FTP or anything, that if they were to look at the file where it’s in they wouldn’t be able to read the password, however, curl would be able to read it and still use it properly?

Thanks!
M

Answer 1

If you encrypt your password your curl script will have to decrypt it to use it as the password for your PHP task.

To encrypt your password you will have to use an encryption key, also known as a password. You will need the decryption key stored so your curl script can decrypt the password used for your PHP, but now you’ve stored the password for decrypting the password.

This is the problem that that all DRM (DVD encryption for example) runs into — you have to make the keys available to decrypt what you’re trying to protect, and you therefore compromise security.

Your best bet to be secure is to have a driver “program” (could be a script or whatever) that interactively asks for a password and hangs onto it until it’s time to run the real job (your curl script in this case) at which time the driver can supply the password.

Alternatives to be completely non-interactive are to keep the password like you are now, but maybe in a less available space than the source itself, or to use certificate authentication to negotiate a secure and trusted connection – which of course involves getting certificates from a Certificate Authority.

Security is Not Easy.

---

And I second the answer mentioned by Teofilo Israel Vizcaino Rodrig in the comments.