Storing login/password in twitter client

Question

I know that storing such a sensitive data is a bad idea. But if application will ask password every time when it's starts it'll be annoying... I know about OAuth but this is just the same thing - user will be interrupted with browser(or i'm wrong? - this moment is not clear for me). I know about symmetric cryptography. But how to store the key inside application securely?

The question is simple. (but has two parts :-)

1) Whether it is possible to send login/password pair not as plain text?

and

2) If NO, why i should think about security(in my application)?

If you found a misspelling feel free to tell me about it

Answer 1

If this intended to be a Windows-only .NET application, you should look into the Data Protection API (DPAPI). It delegates the specific security implementation to Windows, which in turn secures the data to disk using the user's Windows profile/credentials. Since that's tried and true, thoroughly vetted and constantly held up to attack, you can store info worry-free and focus on the parts of your application that matter to you.

It's very easy to use DPAPI in .NET through the ProtectedData class:

ProtectedData.Protect(data, entropy, DataProtectionScope.CurrentUser);

If you are curious about the precise implementation of the underlying security, it's discussed at length here.

Answer 2

The password is not encrypted when sent to twitter because it uses http basic authentication and twitter doesn't use require SSL for their api. Like all basic auth, the username and password are BASE64 encoded, but that's hardly any security at all.

The reason you would store it securely is so that your app isn't responsible for leaking a bunch of users' passwords should something go wrong.

I'd strongly urge you to consider using OAuth. It's better for a lot of reasons, and doesn't require that your users trust you with their twitter credentials. You can store the access token and token secret much like you would a username and password so that the user doesn't have to log in every time, and you don't have to worry about being responsible for a widespread security breach. The downside is it's a bit harder to use than basic, but not terribly so.