CODEWITHSUNDEEP
passwordspassword-storage
Tom Lehman
Tom Lehman

Reputation: 89203

How to store a user's password to another web application

I'm building a web application that shows users interesting visualizations of their Gmail activity (who they're emailing the most, etc). Obviously the user needs to give me his Gmail password to use the application, and I'm wondering how I should store it:

  1. Store the Gmail password in plaintext. Risky!
  2. Don't store the Gmail password at all; force the user to enter it every time he wants to sync data. Potentially inconvenient!
  3. Encrypt the Gmail password before storing it. The user's password to my application is the key.

Something like (3) seems best, but with (3) I can only sync data when the user logs in (since I won't know his password to my application at any other time), which isn't ideal. I'd prefer a Mint.com-like solution whereby the user can click a button to sync data from Gmail at any time without re-entering his password (any idea how Mint accomplishes this without storing your banking passwords?)

Upvotes: 1

Views: 358

Answers (2)

Matthew Flaschen
Matthew Flaschen

Reputation: 284796

As of 4 days ago (good timing!) Gmail supports OAuth for accessing message data through IMAP. This means your apps never needs to see users' passwords. The documentation includes libraries and sample code.

Upvotes: 7

Srikar Doddi
Srikar Doddi

Reputation: 15599

You are getting into a very risky business of account aggregation kind of deal here. Yodlee does the account aggregation for Mint, and in fact Mint does not store the banking passwords as WhirlWind suggests. Mint offloads it to Yodlee who may store or could have some kind of secure integration with banking institutions. My advice is to not store the passwords and let the users enter it everytime or use the limited OAUTH that google lets you use. Not sure if you can get all you analytics from this.

Upvotes: 1

Related Questions