5
$\begingroup$

I'm new within the area of crypto so I apologise if I am bad at explaining this, or have misunderstood certain areas.

I'm currently developing a Java Fx application which includes the use of a 'remember password' option.

The password needs to be reversible. So in this case I need to use encryption (I know hash + salt (e.g. using Bcrypt) is better but I cannot do that without the user having to enter their password every login).

I'm just wondering what the best way to achieve this is.

For example, I could create a Java KeyStore to store a key pair and then store the password encrypted elsewhere in a configuration file. But I'm not sure how to go about storing the password for the KeyStore. Also, I'd need to encrypt the private key right? And would need to secure the passphrase for the private key? (Again, I'm a nooby so correct me if I've misunderstood anything)

Does anyone have any advise on a good, secure method to handle this? It doesn't have to be the way I have explained (using JKS) - I'm open to alternative approaches.

$\endgroup$
1
$\begingroup$

There is no way you can make this secure without using some kind of DRM or additional devices. If an attacker has access to the running program then the attacker is able to retrieve the password. You can of course try to hide and / or scramble the password in memory, but that's about anything you can do. It then comes down to obfuscation.

Sometimes the operating system has access to additional resources to secure passwords. You need to provide your password to the operating system almost by default. So for instance Windows has a Credential Manager that you can access from your applications. I looked around and I found some way to make use of it here (warning: I've never used or viewed this solution). Obviously such code won't be portable across operating systems.

In the end, you're probably better off trying to protect your application itself. Make sure your input is sanitized and that the debug port isn't left wide open. Make sure you limit access to the application. Once an attacker has full access to a user account - or worse, a system account - then your application security is probably the least of the user's worries.

$\endgroup$
  • $\begingroup$ Also note that if passwords are kept in plain within the program's memory, any dump will reveal them. $\endgroup$ – Dreadlockyx Mar 26 '17 at 9:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.