3

I'm writing a small utility in AutoIt that connects to Twitter. I would like to store the username and password in the programs setting file, but I know that it needs to be encrypted obviously. Previously when I've done this for personal use I've just adopted an iniformat - written to a temporary file and then encrypted it using a rediculously long password and 256 bit AES encryption, just calling the file "settings.eini".

However, I'm going to be offering this utility to the public. I don't expect a large amount of people to use it or for it to become a target, but I thought that it's best not to take chances. I've been reading about creating custom file extensions and it seems like something I want to avoid for now, so is there a standard/acceptable way of doing this?

Improve this question
5
  • Are you trying to protect the user's twitter account or a system account that your application uses?
    – Mike
    Feb 21, 2013 at 13:43
  • @Mike The user's twitter account.
    – Andy
    Feb 21, 2013 at 13:45
  • 2
    Have you explored the OAuth mechanism for twitter clients? It does not require storing the login and password at the client.
    – Devendra D. Chavan
    Feb 21, 2013 at 15:09
  • @DevendraD.Chavan My application does use the OAuth mechanism but I don't really understand how I can avoid storing the password? I understand how it works but can somebody explain what I need to store please
    – Andy
    Feb 21, 2013 at 16:12
  • @Mike Just of interest, how might the answer differ if I was storing details for a system account also?
    – Andy
    Feb 21, 2013 at 16:53

1 Answer 1

Reset to default
1

Encryption is only as good as the means to decrypt it. While it keeps out most people, anyone with reasonable knowledge of encryption could reverse engineer the username and password. So logically, the solution is to make it difficult to reverse engineer. The best mentality to adopt when trying to achieve this is assuming that someone wanting to crack your program knows everything that you know, how do you make it difficult to decrypt even then?

One solution that I've found is by drawing from some information that's unique to that computer like, say, the hard disk serial number. Using that as a key, you can encrypt and decrypt the username and password and so long as your source code is protected and your program is obfuscated, nobody would be the wiser. It only has the minor downside that it can't decrypt these values if the folder is copied to another computer (hence a different hard disk serial number).

Another approach is to make a formal https request to a server which provides a key that is used to encrypt and decrypt, making it impossible to decrypt by using the key, since the key is not saved locally. It has the drawback that it requires the computer to be online, but since it has to access twitter anyway, I'd say that drawback doesn't apply to you. It also doubles as a way for you to authenticate usage of your program by proving that the license used for that program isn't used under a different IP. This is becoming an increasingly popular approach since the number of computers that work offline are always fewer and fewer.

Improve this answer
4
  • Thank you for your answer - it is thought provoking. To be honest though, I'm not sure about using the hard disk serial number and making a HTTPS request seems a bit overkill for this application. My other question was also if there is any standard file format to store the encrypted data in because I'm not sure it is acceptable to store encrypted data in a .ini file, is it?
    – Andy
    Feb 21, 2013 at 16:19
  • Hmm, the encrypted version for AES is binary data, isn't it? You could convert it to Base 64 encoding so that you're guaranteed to be able to save it in your ini file, but I'm guessing that'd be overkill as well. My advice would be to save it in a file separate from your ini file which would be binary-encoded.
    – Neil
    Feb 21, 2013 at 16:33
  • Oh right yeah - that makes sense. Simple but effective. Just what I need. Thanks for your answer again, it should be useful for future projects. Just one last question - what should the file extension for that separate file be? Is there some sort of standard or should I just create my own?
    – Andy
    Feb 21, 2013 at 16:50
  • @Andy, you can call binary files .bin, but that's just the binary equivalent of .txt. In other words, if you're the only one reading this file, you don't really have to worry about the OS incorrectly opening that file.
    – Neil
    Feb 25, 2013 at 8:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.