How to store a user's password to another web application

Question

I'm building a web application that shows users interesting visualizations of their Gmail activity (who they're emailing the most, etc). Obviously the user needs to give me his Gmail password to use the application, and I'm wondering how I should store it:

1. Store the Gmail password in plaintext. Risky!
2. Don't store the Gmail password at all; force the user to enter it every time he wants to sync data. Potentially inconvenient!
3. Encrypt the Gmail password before storing it. The user's password to my application is the key.

Something like (3) seems best, but with (3) I can only sync data when the user logs in (since I won't know his password to my application at any other time), which isn't ideal. I'd prefer a Mint.com-like solution whereby the user can click a button to sync data from Gmail at any time without re-entering his password (any idea how Mint accomplishes this without storing your banking passwords?)

Answer 1

As of 4 days ago (good timing!) Gmail supports OAuth for accessing message data through IMAP. This means your apps never needs to see users' passwords. The documentation includes libraries and sample code.

Answer 2

You are getting into a very risky business of account aggregation kind of deal here. Yodlee does the account aggregation for Mint, and in fact Mint does not store the banking passwords as WhirlWind suggests. Mint offloads it to Yodlee who may store or could have some kind of secure integration with banking institutions. My advice is to not store the passwords and let the users enter it everytime or use the limited OAUTH that google lets you use. Not sure if you can get all you analytics from this.