I’m currently writing a simple FTP client (using C# and .NET). It’s important that users be able to “bookmark” their previous FTP connections–including authorization information, so they don’t have to type the password again every time.
Is there any way I can do this securely? How do other programs, like Filezilla and Firefox, manage to store user logins?
I can suggest you to store FTP login data of your application as an encrypted file in the file system (for each logged user). To do it, user should use some global password to unlock this storage (decrypt file). In Mozilla apps it is called “master-password”.
When your program starts, user should input master-password (maybe as a pair of login and user-password). Than, using this master-password (or some derivative info) as key, stored file (with FTP login data) will be decrypted. This way is safe, cause you use encryption with the key, known only to app’s user.
Moreover, this password should be used on login step to your application. Or anyone can run your app and get FTP login data. Something like… User runs your app. Inputs his login & password. Program uses them as key for decryption. If decrypted data is not a text-mess – user logged correctly.