6

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use.

Are there any similar password store options that are cross-platform and have the following properties?

  • Store the credentials securely
  • Ability to authorize applications to access the credentials repeatedly without re-authenticating?
  • Credentials are accessible via an API (provided the user has authorized one-time or indefinite access)?
  • (Nice-to-have) Ability to authorize applications for a specific time period (i.e. a week or a month), after which the user is required to re-authorize the application.
  • (Nice-to-have) Support for multi-factor authentication during authorization

Keychain works great in this sense, since it allows me to let them be responsible for the security of the credentials, and allows the credentials to be used by other applications (provided a structured credential key) with authorization that can be one-time or indefinite.

I've attempted to the scour the web (probably poorly), but I'm having trouble with the fact I only get password managers, which are geared towards a user requesting the credentials, rather than an application, or I get instructions for how to properly store using bcrypt, which is great for verifying passwords, but not if I need to retreive it later. For instance, I have a proof of concept for storing the credentials in LastPass, but it requires enter a master password each time the credentials are requested unless I store the master password somewhere accessible, which kind of defeats the purpose of the password manager in the first place.

Improve this question
6
  • 1
    got a down-vote with no feedback, what gives? assuming i'm just using the wrong search terms here, and a simple search for "password _______" will point me in the right direction
    – Ralph Callaway
    Apr 20, 2015 at 2:57
  • You can get the source code for keepass, modify it to suit your needs - keychain on Mac is basically the same thing - a secure place to write your passwords.
    – gbjbaanb
    Apr 20, 2015 at 8:00
  • How does the multi platform fit in here ?
    – phil soady
    Apr 21, 2015 at 13:15
  • @philsoady this is being used by a npm package that drives a sublime text plugin that is used on windows, mac, and linux. The setup on mac uses keychain which i love, the windows and mac have something less than desirable which i'd like to replace with something like keychain.
    – Ralph Callaway
    Apr 21, 2015 at 16:26
  • @gbjbaanb keepass sounds like a good option, any differences from keychain?
    – Ralph Callaway
    Apr 21, 2015 at 16:40

3 Answers 3

Reset to default
3
+50

What you are looking for is Symmetric encryption when the original data is required again. ie Store the important data using Symmetric encryption. Your application then provides access to external applications that can provide a User and password. The calling tools is authenticated against an Asymmetric stored hash. Such as bcrypt for the Hash.

You can allocate a cookie if the caller is using http to reduce re-auth.

Take a look at Security exchange You can post serious questions about good ways to do things safely regards security.

Improve this answer
3
  • thanks for the pointers and yeah, thought about posting to security exchange, but felt this was more of a programmer question since I'm looking for existing applications
    – Ralph Callaway
    Apr 21, 2015 at 16:21
  • are there modules for this? my hope was not to implement the security since while it would be fun and interesting, i'm not a security expert and would much prefer to use a smarter person's code
    – Ralph Callaway
    Apr 21, 2015 at 16:25
  • 2
    Depending on the language, C++ c# java, you will find a library for both symmeteric and asymmetric encrypting/hashing.
    – phil soady
    Apr 22, 2015 at 8:31
1

I think Oauth providers (twitter, google, fb) will give you what you want:

  • they (arguably store credentials securely
  • ability to authorise applications (not only users)
  • available from API
  • there's probably more features that interest you

All you need is to register your application and make some redirections for authentication. It might be not ideal to use 3rd party authentication, but these days who doesn't. Some users might even prefer to use their existing accounts.

If 3rd party doesn't work for you, you can always implement Oauth yourself.

Improve this answer
1
  • not sure that applies here, it's a dev tool talking to salesforce so it has to have the credentials and repeatedly. so it's a matter of storing them somewhere safely that I can retrieve them again later (ala key chain on a mac), but thanks for the answer!
    – Ralph Callaway
    Apr 23, 2015 at 1:10
1

In a nutshell, you are writing a program that reads information from a protected secure storage facility (so it can call external APIs). The secure storage facility itself has it's own authentication (username/password and possibly multi-factor authentication).

And the key is that this authentication to the secure storage facility you want to persist somehow, so that the program doesn't bug the user for it repeatedly over time, presumably across program restarts (maybe even operating system restarts).

So you want two storage facilities!

The first protected secure storage facility stores all the external API credentials. The second protected secure storage facility stores ONE THING -- credentials to the first storage facility.

At this point, you want help on building the second storage facility. The entire problem is reduced to one question: "How do I store one set of credentials"?

SSH solves this with ssh-agent (here) "ssh-agent allows the user to connect multiple times without having to repeatedly type the passphrase". You start ssh-agent near the beginning of user login, and it sticks around until you logout or shutdown.

But that doesn't help you across logins. Linux solves this with keychain (here) "Keychain will allow you to reuse an ssh-agent between logins, and optionally prompt for passphrases each time the user logs in"; (here) "re-use ssh-agent and/or gpg-agent between logins".

You mentioned your Mac OS uses keychain, which I assume is the same thing.

For Windows the question seems to be answered here (here) "Is there an equivalent of the OS X Keychain, used to store user passwords, in Windows?"

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.