Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose I need to store login information for a third-party website for a few users, how would I go about doing it?

Since I am logging into a third party website, I need the password in plain-text, not hashed. And no, the website in question does not provide any API.

In addition, the server I am using is accessible to people whose credentials are stored on it, so they will be able to get at least one plaintext/ciphertext pair, namely their own.

Given these two conditions, is there any way of storing user credentials on the server, or should I just ask for them each time the user logs in?

share|improve this question
What do you mean they need to password in plain text? Generally user credentials for a web site do not require the actual password. If you are handling the login/authentication you can store the password how ever you like(I recommend something actually secure like a salted hash). This would probably be better answered on IT Security SE though. – Chad Aug 8 '11 at 13:21
@Chad: He wants to login to a third-party website (from his website), which means that he has to have the login data (userame + password) in some form usable for login. – Paŭlo Ebermann Aug 8 '11 at 16:50
@Paulo - So he wants to play man in the middle? If the site does not provide an api or accept one of the many OpenID Type solutions that exist already this seems like he is asking for help setting up a man in the middle attack. – Chad Aug 8 '11 at 16:56
@Chad No attacks, I promise. The users will voluntarily provide me this info, since it makes their life easier. Lets just say that this third-party site does not present data in quite as beautiful a manner as I will – Soumya Aug 8 '11 at 18:11
@Soumya92 - Well just because he users give you the information does not mean this is not a man in the middle attack. If you are impersonating their customers and then taking the data and doing something with it on your site that is a man in the middle attack. Just because it is not malicious to the user does not mean that it is ok. And storing their passwords at all for you is probably not a good idea. If your site gets hacked then you have comprimised 2 sites by your ineffective security. – Chad Aug 8 '11 at 18:47
up vote 8 down vote accepted

You could encrypt them using some key derived from the user's password (to your site).

Of course, this assumes that you get your user's passwords in plain text (or in any form which is always the same) - thus you need to have an encrypted connection to your user. Do not allow any non-SSL login.

You can use some key derivation function like PBKDF or bcrypt to derive the encryption key from the password (if this uses a salt, make sure the salt is not the same as you are using for your password checking). You could additionally use some server-secret here, but if your say that some potential attackers have (read-)access to the server anyway, this will not really increase security.

Then encrypt/decrypt the stored login information for the third party website using a standard symmetrical encryption algorithm like AES.

Of course, you also should use an encrypted connection to this third-party website.

share|improve this answer

The method that Last Pass uses is quite optimal, in my opinion. They have a set of passwords that is encrypted on your machine using javascript, and your provided password. You send the encrypted data to LastPass, who stores is on their server. When you want to access your password, you send the same encrypted text back to the user, who decrypts it on their machine.

The end result, you never know their password, but you did store it for them.

share|improve this answer
You still have to trust them (or more exactly: their JavaScript) that it does not transfer your password to them, too. – Paŭlo Ebermann Aug 11 '11 at 12:06
Yes, but there are packet sniffers that one can use, that supposedly security experts have verified. It's still a better model than storing decryptable passwords on your site. – PearsonArtPhoto Aug 11 '11 at 13:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.