Store a Password Securely.

Question

I need to "password protect" my application but need advice on where to store the password securely.

How I intend to do this:

The first time the program is run, I will prompt the user to create a password. The password will be salted and hashed in SHA-256 then stored in either the Registry or a file.

The Problem:

If I store the hashed password in the registry or a file (or both) then it would be too easy for someone to just delete the Key in the Registry or the File and be prompted to create a new password...

How can I securely store the hashed password so that it makes it harder to be deleted?

I have thought about storing it in the Registry and also creating a file with the Hidden and System Attributes to read from in the event of the Registry file being deleted but this seems silly as it could also be deleted quite easy.

// I hope I have posted this question correctly with the right Tags - I am new here so please go easy! ;)

All the best

Chris (Shamballa)

Answer 1

This is basically a Programming Ethics 101 issue. If you're storing information on someone else's computer, remember that the computer is their property and they have the right to delete or modify any file or registry key on it. Trying to make it so that they can't is a very bad idea.

There's a good reason why you can't do it. What would happen if someone started putting files that you can't delete or modify on your computer? Extrapolate to the logical conclusion: What would happen if a virus started putting files that you can't delete or modify on your computer, and did so in an infinite loop until the hard drive was full? You know if it was possible, someone would try it.

If you want a program that stores a password somewhere where the user can't modify it, put it on your server and have your program contact it over an Internet connection. (Which is an entirely different can of worms, but at least you're not trying to do impossible things or violate your users' basic property rights anymore.)

Answer 2

The best solution would be to rely on an external source that the user can NOT control to store a portion of the password. Otherwise no matter where you hide it, it can easily be discovered by someone with a few free tools and a little time.

Personally, I have found the best place to store such data is in the open, along with other data that is frequently accessed by the application. Keep in mind that if the user has access to modify the data, it is at risk.

If you want to lock down your program, require that the key already exists before your program runs. This way you only have to worry about how you get them the key, and since it is encrypted it would be harder for them to create one which works for your system.

For your initial authentication process, you can place a part of the key on your webserver, give the user a passkey required to create the encrypted file. Using the pass key would lead them to the key on your server and if it is valid then allow them to save the encrypted file. If your worried about re-activation then once its activated you can delete the file on your web-server.

Another option would be to use something like OnGuard (latest versions) to encode a time-limited key that you give to the user. Then when the activation is run check to see that the key you supplied has expired or not and if so then not allow activation. This way your activation key is only at risk for a limited amount of time.

Don't spend TOO much time on this. Even the best algorithm can be patched around with a few NOP instructions after the app is deployed.

Answer 3

You can securely store a password for an application using the Windows crypto API. There is an example of it's use in CodeGuru, but it is written in C++, not Delphi. The code is not too challenging, so should be relatively easily converted to Delphi.

A more advanced solution would be to ask the user for the password before downloading the application, and embed the hashed password part of the binary - of course if you obtained multiple copies of the application you could easily determine the location of the encrypted value, and the code checking it in order to remove it.

The issue is that you have not created any value from the use of the password, i.e. it seems to just be a password on it's own. You should use the password as a seed for encrypting the application's data, and tie the password to the data. Lose the password and you lose only the data.

Answer 4

There are at least 2 ways I can interpret your question.

(1) You want to store passwords so they can be used later to login to a remote database.

This answer on Password encryption in Delphi explains the encryption part.

That way you can store a password so it later can be used to authenticate the user when he logs in using your application on a database server or something.

The "not delete" part is really sensitive for users; I would not do that.

(2) You want to store a password, so it can be used to validate a user to locally access your application.

This is more difficult, as basically you can't.

The closest way is to keep a background process running that keeps a lock on the file.
You communicate with that process to unlock the file so you can verify the password.

--jeroen

Answer 5

If you only need one password, encrypt and tack it on the end of the .exe. I have done this successfully many times.

Answer 6

I would suggest using the Authentification Functions in Windows, specifically CredWrite and CredRead. It would also be possible to use the encryption windows provides (CryptProtectData/CryptProtectMemory) and then save the credentials

EDIT: If you need the headers for Delphi, they are available in the Jedi Windows Api Library.

Answer 7

You didn't really specify what this password is protecting. I'll assume it is used to protect the data created by your program.

I'm no security expert or cryptographer but if the data is stored locally the solution is simple. Store both the password(or more likely a hash of the password) and the data in the same place (file, DB, etc), encrypted with separate keys.

This prevents circumvention by file deletion. They'd delete all the data as well. This will thwart all but the most determined end user.

Answer 8

Judging from your description, you don't understand that if all the security you have is

if not SameString(Hash(UserPassword), StoredPassword) then exit;

Then you have no security at all, and it's not a matter of user deleting your password file. User can just open your exe file in any binary editor and nop out the part which does the check:

//if not SameString(Hash(UserPassword), StoredPassword) then exit;
//Check commented out ---malicious user

You have to realize that even though you compile your app, it still contains all the source code, just in assembler. You can still edit the source, it's just a bit harder because it's in different language now.

Therefore, if you want to prevent user from doing something in your app, there are only two ways:

1. Write-protect your app and it's files. Or store them on a separate server, if you're not in control of this one. Or just make them a service which accepts only a fixed set of commands.

2. Make it so that app does not check it, but encrypts something critical with password. Sure, malicious user can reset password or even delete the decryption routine altogether, but he will still have to decrypt the data.

Every other solution could be circumvented, all that differs is the time and skills it'll take to circumvent. For instance, you can encrypt a critical part of application code and decrypt it on-the-fly (did that once). Then execute and encrypt back. Without the right password your app will never run.

But a malicious user can install a separate copy of the app with known password, examine parts of the program when they're decrypted and assemble them into the unencrypted source. Sure, that's a lot of work. But it can be done in a finite time.