I need a way to store third party credentials, and I want to avoid storing passwords in plain text. I can't use a hash because I will need to be able to get the raw password to log in to the third party service.
My idea is to use a master password that I enter on the startup of the service that will be used as a key to encrypt and decrypt the users third party information. The only flaw that I see with this method is that I (or anyone who can somehow get the master password) will have access to user data for the third party service.
Alternatively, the user can enter their third party login credentials when accessing my service, and my service can access the third party site. However, the service is supposed to run 24/7 and this method would require them to reenter their login credentials every 8 hours rather than only once.
Are there any significant flaws with either of these methods, or is there any better approach to solve the problem?