I’m making a twitter client, and I’m evaluating the various ways of protecting the user’s login information.
IMPORTANT: I need to protect the user’s data from other other applications. For example imagine what happens if a bot starts going around stealing Twhirl passwords or Hotmail/GMail/Yahoo/Paypal from applications that run on the user’s desktop.
Clarification: I asked this before without the ‘important’ portion but stackoverflow’s UI doesn’t help with adding details later inside the Q/A conversation.
- Hashing apparently doesn’t do it
- Obfuscating in a reversable way is like trying to hide behind my finger
- Plain text sounds and propably is promiscuous
- Requiring the user to type in his password every time would make the application tiresome
Any ideas ?
This is a catch-22. Either you make the user type in his password every time, or you store it insecurely (obfuscated, encrypted, whatever).
The way to fix this is for more operating systems to incorporate built-in password managers – like OS X’s Keychain. That way you just store your password in the Keychain, the OS keeps it secure, and the user only has to type in 1 master password. Lots of applications (like Skype) on OS X use Keychain to do exactly what you are describing.
But since you are probably using Windows, I’d say just go with some obfuscation and encryption. I think you may be slightly paranoid about the password-stealing-bots; if your application doesn’t have a large userbase, odds are pretty low that someone will target it and specifically try to steal the passwords. Besides that, they would also have to have access to their victim’s filesystem. If that’s the case, they probably have a virus/worm and have bigger problems.