Can passwords for other sites be stored securely?

Question

My university has a portal which students use to register for classes. If you want to get into a full class, you have to keep checking the portal, and sign up when the class has an opening.

I wrote a tool that can check for openings and register automatically, but it needs the students university username and password. These passwords are tied to email accounts, network shares, server logins, and most every other university service.

Is there any way to do this securely?

Answer 1

You could encrypt the password strings when you store them and then decrypt them when you need to try logging in. Simply generate a symmetric key and use that to encrypt and decrypt the passwords for storage and retrieval (respectively).

Answer 2

You can't store them entirely secure because you'd need to be able to encrypt and decrypt so one-way hash algorithms like MD5, SHA-1, SHA-2 wouldn't suffice. You could look into something like DES or Triple-DES encryption.

Answer 3

In security, the most important thing is the "threat model". What kind of attack do you fear?

• somebody may steal the computer where this program runs on: put the computer in a locked room.
• somebody may hack into the computer and read it from memory: use firewalls and other protection against remote attacks
• other users may read the hard disk where the password is stored: only store the password in memory (which would require re-entering it every time you start the program)
• the super user may read the password even if it is in memory: only run the program on a computer where you trust the superuser.

etc.

Answer 4

Unfortunately, this is not really possible -- at least not the way you want to do it -- unless the university provides a key-based authentication API. You could always ask them nicely, but they'll probably be too busy to help. If you give your users full disclosure and keep your server secure, it should be enough.

Actually, there is one way to do it through the web without storing passwords -- you could use a Java or Flash app. Unfortunately your users would need to leave the browser open while the app does its work, but this way you wouldn't need to store the information.

Answer 5

I do not think there is. As Martin pointed out one way encryption won't do it for you. Also this will create a maintenance nightmare for you - every time a user changes password you will have to update your data.

I think to make it really work you have to change the design: find a way to do the registration without the user password, i.e. talk to the owners of the app if they would give you an account through which you can do registration on behalf of somebody else