5

I'm working on an add-in that will integrate git into the VBA IDE. I'm using the LibGit2Sharp library under the hood, which supports User name and password credentials, but not SSH Keys. I would use GitHub's SSH Keys if the library supported them, but it doesn't.

So, I can easily enough ask the user for their credentials prior to trying to interact with the remote repository, but I can feel the "bug" reports coming in already.

Why do I have to provide my password every time I try to push to my repo?

So...

Question 1:

Is it safe and acceptable to keep the password in memory after the user has entered it the first time? If there are caveats to that being safe or unsafe, what are they?

Question 2:

I can also see users not wanting to keep entering their password even on the first time they push during a session. Would it be safe enough to encrypt (not hash) the user name and password and store them along with the add-in's other configuration settings?

I mean, Visual Studio doesn't ask me for my GitHub credentials each time I start up the IDE, so it must be possible to do this relatively safely. But how?

I have read through many related questions, but feel no closer to knowing how to go about safely using my users' credentials in my add-in. Most of the existing questions relate to websites and databases, where the right answer is "don't store the password in a recoverable way, salt and hash it and store the hash only", but in this instance, it's not a password to my service. I need to secure it the best I can, but in a recoverable way. Otherwise, there's no way my program can "log into" their repository on their behalf.

Improve this question
5

1 Answer 1

Reset to default
1

The safest way to "store User's third party credentials" is to not store them - if you store them, you have two major issues:

  • they may change before you update your cache of them (seen this several times)
  • your app could be compromised, compromising unknown numbers of users' third-party creds

And probably many more.

You either need to use a different system (OAuth, OpenID, LDAP/AD, SSH keys, etc), or you need to get the user's credentials every time they want to use them.

Saving them is only going to cause you heartache down the road.

Improve this answer
3
  • This may sound naive, but is there really that much risk to storing them for the duration of the session? This isn't a web app. The user's machine would already have to be compromised for anyone to attack my plug-in.
    – RubberDuck
    Commented Apr 6, 2015 at 19:50
  • Also, as I pointed out, the library I'm using doesn't support other methods of authentication.
    – RubberDuck
    Commented Apr 6, 2015 at 19:51
  • 2
    @RubberDuck - it's [relatively] trivial to read a program's memory and find actively-used data. You should always assume the machine you are running on is compromised - it's Security 101.
    – warren
    Commented Apr 6, 2015 at 19:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.