4

I know I should encrypt the password whenever I save passwords for security.
But I don't know how should I encrypt password that when I save for autologin.

If the password was just for checking user, I can encrypt passwords with one-way encryption like pbkdf2. But the password should be protected, and I should access it when the program started. How can I securely save & use passwords?

  • 1
    You have not elaborated on your use case. I assume its an application that uses web service of some sort. This is what we use in production with published desktop apps. We normally generate a token similar to browser sessions. It has a lifetime similar to browser sessions and stored in user-centric location that only the current OS user has access to. We dont store passwords in any way – Abhishek Dujari Dec 31 '16 at 16:32
  • @Vangel I am making just a client. (Like an helper) so I don't have an internal access to server. So I need to save passwords... – CodingBear Jan 1 '17 at 1:16
  • why can't you use the one provided by OS..like keychain for Mac OS or Password vault for windows ? – rajaganesh87 Jan 2 '17 at 7:12
  • Possible duplication of: softwareengineering.stackexchange.com/questions/73467/… . – Machado Jan 2 '17 at 16:00
  • You shouldn't stop at asking how, but also ask where. You always need to plan for computer failure. Also ask yourself whether you want your solution to work on just one device rather than all of them. – SDsolar Jan 23 '17 at 7:51
10

But I don't know how should I encrypt password that when I save for autologin.

Autologin is not based on the password used in a manual login. There is a separate credential (based on identifying and non-identifying information) that is generated after a successful login, and that credential is stored on the client in an encrypted cookie or similar storage mechanism. More details on this approach can be found in this article

I know I should encrypt the password whenever I save passwords for security.

The use of 'encrypt' here is dangerous, encryption implementations are generally two-way. Passwords should be 'hashed', a one-way mechanism that provides no trivial way to view the original input.

Note that virtually all custom authentication schemes are designed insecurely, don't build this if you don't have to:

  • 3
    There are many areas where it is best to use a proven library and encryption / authentication is at the top of that list. After 40+ years of programming I still am not smart enough to get this stuff right every single time. – Peter Rowell Jan 1 '17 at 23:49
  • Nobody is. You are absolutely correct, @FMJaguar. – SDsolar Jan 23 '17 at 7:50
2

Wiring as Answer as it exceed comment limit.

You need to follow HTTP protocol. saving password by some homegrown solution is inherently unsafe. Even if you dont have access to server you have access HTTP endpoint? Do a normal login, see what cookie is set. It should have the session. Which means you can do the same on the client. Save the session is what I am getting at.

If it's not HTTP or even if it is, you just have to use a OS Keychain to save password.

Mac - https://github.com/marketplacer/keychain-swift

Windows : https://stackoverflow.com/questions/12539382/how-to-remember-username-or-password-for-login-form and related SO question https://stackoverflow.com/questions/12539382/how-to-remember-username-or-password-for-login-form

In this case, you let the OS security handle protection of User account and don't try to reinvent the wheel. The question you should be asking then is how do I go about implementing the OS best practices of saving user settings, which is easier and part of most libraries you will work with.

  • So, Is it save sessions in client's computer? – CodingBear Jan 1 '17 at 11:58
  • yes. save the sessions and use the session ID back, if session has expired, the password prompt should reappear. Its all in the cookies. Your headers should resend the cookies in order to login as well as for all HTTP requests. – Abhishek Dujari Jan 1 '17 at 17:23
  • But that will work on just one computer. What about other devices like tablets and smartphones? – SDsolar Jan 23 '17 at 7:49
-2

I suggest you look into Lastpass. It gives the benefits of autologin and all the decryption is done in your computer so even if they get hacked (which they did) the perp only get unusable garbage. Not a single password got hacked even though they got the entire database at that time.

And I didn't have to become an encryption specialist; I just saw the results of a concerted effort to break it. It survived intact.

Another perk to using it is that it can auto-generate passwords that are unguessable and unique for every site.

Very easy to use, and about as secure as one can get with passwords.

And the best part is that it works on my computers, tablet, smartphone, everywhere. I can login on unsecured computers like in the library, if I want, too.

It just plain works.

http://www.lastpass.com "The last password you will ever need"

I couldn't be happier with it.

  • It's not clear how LastPass would help here, as you still need to login to LastPass. – walpen Jan 23 '17 at 1:22
  • First is that it works on all my devices at once. And the passwords are never stored in my own computer nor do I need to be an encryption expert in order to evaluate the strength of my password storage. Not only are they safely encrypted but I'll survive the inevitable loss of my primary computer (by age, HD failure, whatever). And yes, you do need to login to Lastpass. "It is the last password you will ever need" The best part is that all of my passwords are completely random. My bank, bitcoin exchange, eBay, Amazon, etc., It has been proven that they cannot be hacked nor lost. – SDsolar Jan 23 '17 at 7:44
  • you don't need to sell me on LastPass -- I've been a user for a while -- but it is not clear how this answers the OP's question. They seem to be asking about how to implement auto-login from an app's developer perspective and not about password management from a user's side. – walpen Jan 23 '17 at 8:08
  • Hmm. I didn't read it that way. But if that is so, then why not write the app to be Lastpass-compatible like so many others are? btw, when you pay to be a Premium user they bend over backwards to help with any problems. It wouldn't work with my bank at first so they fixed it. They had me send them the link so they could do the job. – SDsolar Jan 23 '17 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.