Key management in Java + Remembering passwords

Question

I'm new within the area of crypto so I apologise if I am bad at explaining this. So correct me if I've misunderstood anything.

I'm currently developing a Java Fx application that includes the use of a 'remember password' option.

The password needs to be reversible. So, in this case, I need to use encryption (I know hash + salt (e.g. using Bcrypt) is better but I cannot do that without the user having to enter their password every login).

I'm just wondering what the best way to achieve this is.

For example, I could create a Java KeyStore to store a key pair and then store the password encrypted elsewhere in a configuration file. But I'm not sure how to go about storing the password for the KeyStore. Also, I'd need to encrypt the private key right? And would need to secure the passphrase for the private key?

Does anyone have any advice on a good, secure method to handle this? It doesn't have to be the way I have explained (using JKS) - I'm open to alternative approaches.

Answer 1

There is no way you can make this secure without using some kind of DRM or additional devices. If an attacker has access to the running program then the attacker is able to retrieve the password. You can of course try to hide and / or scramble the password in memory, but that's about anything you can do. It then comes down to obfuscation.

Sometimes the operating system has access to additional resources to secure passwords. You need to provide your password to the operating system almost by default. So for instance Windows has a Credential Manager that you can access from your applications. I looked around and I found some way to make use of it here (warning: I've never used or viewed this solution). Obviously such code won't be portable across operating systems.

In the end, you're probably better off trying to protect your application itself. Make sure your input is sanitized and that the debug port isn't left wide open. Make sure you limit access to the application. Once an attacker has full access to a user account - or worse, a system account - then your application security is probably the least of the user's worries.