What would be the recommended way for storing passwords in a Java desktop application?
I want the user to have the ability to enter the credencials only once and not be prompted again.
On personal projects I’ve been using the Preferences API, but I’m assuming this is no different than storing it in plain text (security wise).
Many thanks
EDIT:
Many thanks for your suggestions. There seems to be some confusion, no doubt because I might have not made the question very clear…
I’ll give an hypotetical scenario:
Say I’m creating a simple front-end for a remote database which creates a connection string with username/password. Normally the user would be prompted to enter the username/password combination each time the application starts.
What would be the best way to store that password in the user’s machine, without the need to re-enter it (connecting automatically upon application start).
A kind of “remember me” functionality (which I know in itself is not a very good practice…)
EDIT2:
Thanks for your answers everyone.
Paŭlo Ebermann’s was very informative about the problems at hand and Chris Smith’s link was interesting, but I’ve accepted JVerstry’s one, as keystores might be the route I’m taking.
You can use a local keystore where you could put passwords instead of secret keys.
Answer to edit:
Keystores are a perfect fit for your need. If you want extra protection, you could ask the user for one password to access all passwords when the user starts the application. Then, you could protect stored database password with a simple salt-and-stretch method (to generate an encryption key) using the one password that was used when starting the application.