13
$\begingroup$

Suppose I need to store login information for a third-party website for a few users, how would I go about doing it?

Since I am logging into a third party website, I need the password in plain-text, not hashed. And no, the website in question does not provide any API.

In addition, the server I am using is accessible to people whose credentials are stored on it, so they will be able to get at least one plaintext/ciphertext pair, namely their own.

Given these two conditions, is there any way of storing user credentials on the server, or should I just ask for them each time the user logs in?

$\endgroup$
9
  • 3
    $\begingroup$ What do you mean they need to password in plain text? Generally user credentials for a web site do not require the actual password. If you are handling the login/authentication you can store the password how ever you like(I recommend something actually secure like a salted hash). This would probably be better answered on IT Security SE though. $\endgroup$
    – Chad
    Aug 8, 2011 at 13:21
  • 3
    $\begingroup$ @Chad: He wants to login to a third-party website (from his website), which means that he has to have the login data (userame + password) in some form usable for login. $\endgroup$ Aug 8, 2011 at 16:50
  • $\begingroup$ @Paulo - So he wants to play man in the middle? If the site does not provide an api or accept one of the many OpenID Type solutions that exist already this seems like he is asking for help setting up a man in the middle attack. $\endgroup$
    – Chad
    Aug 8, 2011 at 16:56
  • 1
    $\begingroup$ @Chad No attacks, I promise. The users will voluntarily provide me this info, since it makes their life easier. Lets just say that this third-party site does not present data in quite as beautiful a manner as I will $\endgroup$
    – user93
    Aug 8, 2011 at 18:11
  • $\begingroup$ @Soumya92 - Well just because he users give you the information does not mean this is not a man in the middle attack. If you are impersonating their customers and then taking the data and doing something with it on your site that is a man in the middle attack. Just because it is not malicious to the user does not mean that it is ok. And storing their passwords at all for you is probably not a good idea. If your site gets hacked then you have comprimised 2 sites by your ineffective security. $\endgroup$
    – Chad
    Aug 8, 2011 at 18:47

2 Answers 2

15
$\begingroup$

You could encrypt them using some key derived from the user's password (to your site).

Of course, this assumes that you get your user's passwords in plain text (or in any form which is always the same) - thus you need to have an encrypted connection to your user. Do not allow any non-SSL login.

You can use some key derivation function like PBKDF or bcrypt to derive the encryption key from the password (if this uses a salt, make sure the salt is not the same as you are using for your password checking). You could additionally use some server-secret here, but if your say that some potential attackers have (read-)access to the server anyway, this will not really increase security.

Then encrypt/decrypt the stored login information for the third party website using a standard symmetrical encryption algorithm like AES.

Of course, you also should use an encrypted connection to this third-party website.

$\endgroup$
2
$\begingroup$

The method that LastPass uses is quite optimal, in my opinion. They have a set of passwords that are encrypted on your machine using JavaScript and your provided password. You send the encrypted data to LastPass, who stores it on their server. Then, when you want to access your password, you send the same encrypted text back to the user, who decrypts it on their machine.

The end result, you never know their password, but you did store it for them.

$\endgroup$
2
  • 1
    $\begingroup$ You still have to trust them (or more exactly: their JavaScript) that it does not transfer your password to them, too. $\endgroup$ Aug 11, 2011 at 12:06
  • 1
    $\begingroup$ Yes, but there are packet sniffers that one can use, that supposedly security experts have verified. It's still a better model than storing decryptable passwords on your site. $\endgroup$ Aug 11, 2011 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.