I'm currently working on a desktop application in Java (using JavaFX).
This application stores some user information, parts of which are sensitive. For example, if the user configures a proxy, it will store it into a file with encryption. Moreover, my application is calling a web API to execute auto-updates (with a basic authentication scheme).
Currently my application is closed source, and is used in a context that doesn't require high security. The implementation basically contains all the credentials needed to authenticate in the API, or to encrypt user settings. Basically, it contains something like (simplified, it's not "that obvious").
String login = "mysuperlogin", password = "mysuperpassword"; authenticateToApi(login, password); String encryptionKey = "mysuperencryptionkey"; encryptDataToFile(data, file, encryptionKey);
But: I know that this way of doing things is not secure at all! I know that it's possible to "decompile" Java and see the credentials/methods used by the application, and then use them to gain access to the "sensitive" information.
I'm planning to open-source my project this year, so I know I have to get the things done to provide a better security level, here are the options I see:
- Using properties filled on build time to include my credentials directly in the code, without including them into the source: this doesn't solve the "decompile" problem
- Using a key entered by user to secure every information: I don't like this solution because my application needs to be used with the lowest user "technical" intervention. Moreover, this doesn't solve the API credentials problems.
- Generate a key from the current system to encrypt data. But in open-source version, it will be possible to find the current system key, and then use it to access encrypted data.
I suppose that they are a lot of closed/open source programs that have this problems, but I can't figure out what's the "least worst" solution.