Question

I have developed one desktop application in java in which i have taken user’s credentials. I have developed this application to make it run on any plateform. Now confusion is that i am getting is where to store this credential information. Is a file a proper location for it ? Or should i store it according to the plateform used? like in windows i can use registry to store this information. But what about linux and other plateforms? Is there any standard solution which can help me or use of file is the only way to do it? I initially thought to store it in properties file but any knowledgeable person can browse the content of the jar and can have that property file so i think it is also not appropriate solution. Kindly tell me a better way to store this credentials. Credentials are encrypted.

Answer 1

If credentials are encrypted you might just store them in a file, preferably in the user’s home directory. You might also encrypt the file itself to prevent others from reading it directly.

Using this you have 3 levels of security:

1. Only users with access to the home directory (the user herself and any administrators) have access to the file. You also can have multiple files – one per user.
2. The file is encrypted, so only those that have access to the decryption key and who know the encyption method could decrypt it.
3. The credentials are encrypted to, normally using an asynchronous algorithm. Thus the plain text can’t be reconstructed with any reasonable effort.