Storing passwords for batch jobs

Question

I have a little java prog that uses a webservice which needs authorization. So the java prog (which is to be run using windows task scheduler) needs to have a user/password argument. How can I store these somewhere without having them laying around in a file as plaintext?

So far I've tried using runtime.getRuntime and CACLS to have a plaintext file but alter the permissions so only the owner could open it (didn't work, not sure why).

Password encryption doesn't work because if I pass the hash to the webservice, the webservice is just "errr what? denied, get lost", but if I use secret key encryption you need a password to decrypt the password. and where do I store that. :P

Help? Please? :)

Thanks.

Answer 1

Two questions:

1. why do you need to store them externally to the program ? Why not encode within your Java program (do you or the user need to change them?)
2. Can you store them externally, but encrypted ? For instance, you can encrypt using a public key, and store the private key within the program itself. So visibility of the encoded pair shouldn't matter.

You have a problem regardless of either approach, in that you can easily disassemble a Java program. Whichever method you choose, disassembly will make it vulnerable.

Answer 2

how can i store these somewhere without having them lying around in a file as plaintext?

Storing without a "file" will be dificulty. Anyway at some moment you have to retrieve the password from some location.

• Use some symetric encryption for obfuscating so a quick hash does not reveal your password
• Use the OS filesystem (read-only for the user that uses the program, no access all other) to protect the file on local disk or put it on an external drive (flash).

Answer 3

An option is to not use the Windows task scheduler, but rather put your program as a service. Doing so, you can launch your service once with the password as a parameter. Then the password stays in memory for your service and you don't need to store it anymore.

Setting the program as a service can be done quite easily with the Java Service Wrapper

Answer 4

There's no way that you can keep your password safely if someone has authority to access that running machine. Keeping the password encrypted somewhere in memory is the most secure way I think, just like the run-as-service solution above proposed.

For a more sophisticate approach, you can create a daemon which allows you to key in the password, keep it encrypted in memory, and passes that encrypted text to your java program via IPC (socket), then you program will decrypt it to use. But I would never do this... Hihihi...

Answer 5

The simple answer is:

You can't make it entirely secure but you can make it marginally more secure.

You CAN NOT hash the password because this would prevent it's use by your program.

You CAN put the password in a file and protect the file using the OS permissions. You will need to allow the process executing your program read access. This prevents anyone without administrator rights from viewing the password.

You CAN encrypt the password and provide the key in your program. This prevents casual observation of the password by those who can read the file but will not stop (or even slow down much) someone with access to the password and your program.

Anything else is more or less theater.