如何在桌面客户端应用程序（Java）中存储密码和敏感数据？

Question

I want to make an application which will monitor user's email account for incoming emails as well as his twitter account for tweets. The user has to provide his login credentials therefore. My doubt is how and where to store this sensitive data? I don't want my application to annoy the user asking these things repeatedly.

Moreover, if I should encrypt and then store these data then how should I protect the key which I am using in my application?

Answer 1

The point of encryption is to make the secrecy of a plaintext depend on the secrecy of a smaller key.

In the case, encryption alone is useless to you, since you have no way to store the key either.

Instead, you need to use some existing secret managed by a third party (using a password), and use it to derive a key.

On Windows, you can use the DPAPI, which is ultimately backed by the user's login password.
If the user forgets his password (or if it is changed from a different account), your data will be irrecoverably lost.

Note that this will not defend against code running as that user.
You need to decide what you're trying to defend against.

Answer 2

If you really need it (it's no good idea but...) you may want to create encrypted storage for passwords like Firefox has for example. Users will protect passwords with master password.

Answer 3

The answer is nowhere. You should never store passwords even in encrypted form. The "correct" way is probably simulate the behavior of similar web applications. Indeed if you login into twitter you can select check box "remember me" and twitter will not ask you for the password next time, right? How is it implemented?

Typically special token is stored on client side in cookie. The cookie is sent to server and is used for authentication. Cookie has expiration date, so it will be automatically removed when its time is over.

Unless there is better solution for desktop applications I'd suggest you to try to use this mechanism.

Answer 4

我认为使用的密码在您的应用程序范围内，并使用该密码加密所有其他密码，并且在应用程序说需要Twitter时，请使用该密码进行解密...进一步获取主密码的哈希值并将其保存在磁盘上。