Protecting user passwords in desktop applications

Question

I'm making a twitter client, and I'm evaluating the various ways of protecting the user's login information.

• Hashing apparently doesn't do it
• Obfuscating in a reversable way is like trying to hide behind my finger
• Plain text sounds and propably is promiscuous
• Requiring the user to type in his password every time would make the application tiresome

Any ideas ?

Answer 1

You can't have your cake and eat it too. Either store the password (which you've ruled out), or don't and require it to be typed in every time (which you've ruled out.)

Answer 2

You could make some OS calls to encrypt the password for you.

On Windows:

• You can encrypt a file (on a NTFS filesystem)
• Use the DPAPI from C
• Use the DPAPI in .Net by using the ProtectedData class

Answer 3

What platform?

On *nix, store the password in plain text in a file chmoded 400 in a subdirectory of the home directory. See for example ~/.subversion. Administrators can do anything they like to users anyway, including replacing your program with their own hacked version that captures passwords, so there's no harm in the fact that they can see the file. Beware that the password is also accessible to someone who takes out that hard drive - if this is a problem then either get the user to reenter the password each time or check whether this version of *nix has file encryption.

On Windows Pro, store the password in an encrypted file.

On Windows Amateur, do the same as *nix. [Edit: CryptProtectData looks good, as Aleris suggests. If it's available on all Windowses, then it solves the problem of only the more expensive versions supporting encrypted files].

On Symbian, store the password in your data cage. Programs with AllFiles permission are rare and supposedly trusted anyway, a bit like *nix admins.

Answer 4

CryptProtectData is a windows function for storing this kind of sensitive data.

http://msdn.microsoft.com/en-us/library/aa380261.aspx

For an example see how Chrome uses it:
http://blog.paranoidferret.com/index.php/2008/09/10/how-google-chrome-stores-passwords/

Answer 5

Have a good symmetric encryption scheme, it should make it difficult enough to decrypt the credentials that it won't worth trying. Otherwise, if the service only requires the hash to be sent over the network, you can store the hast encrypted. This way even the decryption won't get the attacker closer to the solution. However other users are true. If you store the data it can be found. The key is finding the balance between security and usability.

Answer 6

For Windows: encrypt the password using DPAPI (user store) and store it in your settings file or somewhere else. This will work on a per-user basis, e.g. different users on the same machine will have different unrelated encryption keys.