CODEWITHSUNDEEP
c#encryption
Dwiea
Dwiea

Reputation: 127

Storage of passwords for later use

I want to make an application which simplifies the use of a certain command line program which can ask for a username and password.

I would like to store the password but then later be able to decrypt it and use it to execute the cli app.

I have looked at lots of information but a lot of them say "use a salt / passphrase" but I would like it to act like (as an example) SQL Server Management Studio where you put in your details and save the profile for later use.

An example I found was the following:

Encrypting & Decrypting a String in C#

However this would be weird for a password since you would then need the user to enter two of them. Likewise if you store the salt hard-coded then surely someone can reverse engineer the application.

Upvotes: 0

Views: 207

Answers (1)

Jon Hanna
Jon Hanna

Reputation: 113222

Likewise if you store the salt hard-coded then surely someone can reverse engineer the application.

Yes, so don't make false promises. Applications like database management and FTP software offer to store passwords, but warn about the security risks of doing so,and allow the user to opt out of that feature. As such you could generate a key and store it somewhere other than were the encrypted passwords are stored, and while it won't be secure enough for all uses it will for some. Also, if users might have more than one credential then make this decision one where refusal can be global but not acceptance. (Consider eg a user who appreciates the convenience for test cases but won't accept the risk for other csses).

If there are a great many passwords then a master password might be reasonable, as some browsers and mail clients offer.

Upvotes: 2

Related Questions