3

This is not about storing my user's login details in the app, I already use hash and JWT tokens for that. There is a part of our app where we need to store the login details of the user for another website.

e.g they enter their username and password, it gets stored in my system and then my node server wakes up at night uses their details to login into the other system and pull out the data it needs. What's the best and safest way to store these details in the system as I need the password in text form to log into the website.

We are receiving permission from the user to do this as it is automating an essential part of our data collection for the user. It's just the other website/system doesn't have any other way of providing the data to us unless we want it in paper form in the post.

1

Given the constraints, you should encrypt the password in the database. If you are going to process every user/password every night, you might as well go ahead and encrypt the username too. There are two basic options here: symmetric or asymmetric. Whichever path you choose, you should use high-quality libraries to do your encryption and keep up-to-date with fixes and standards. The hard part here is keeping your private key secure.

I would recommend using a key-pair (asymmetric) here is that you can encrypt the users password using a public key that you store on your server at all times. It's doesn't matter if an attacker is able to get this key and you can make it widely available.

When your nightly job runs, it will use the private key to decrypt the password and access the data. You need to keep this key secure which is a topic that is too broad for this forum but ideally this is in some sort of Hardware Security Module (HSM) or at least separate from the data. If this isn't an option and you need to keep the key in the same place as the encrypted data, make sure you give the key a strong password somewhere else for only the nightly job can use it.

You might start to see that this becomes a 'turtles all the way down' type of problem. Anywhere you put a secret becomes another place that you need to worry about. HSMs are helpful in this case because they are physically designed to prevent access to secrets. This alleviates many of the challenges of key management.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.