如何以便携方式存储密码？

Question

I'm developing simple Twitter reader and I came across following problem: How to securely store the OAuth consumer-key and consumer-secret . Those two passwords are necessary for accessing the Twitter API, but those should be transparent to user.

I was looking at CryptoAPI, DPAPI and encrypted config file, but those will work only for local machine, as they are bound to logged user or specific machine.

So the question is, how to store application level sensitive info in portable way?

Answer 1

Try this:

If there is communication happening between your server and the client, you can use session keys to encrypt/decrypt the secret data.

OR

1. Create a key pair (RSA) or get in touch with Certificate Authority
2. Encrypt the secret keys
3. Send them via n/w
4. Let the client get access to your key
5. Client will decrypt the secret data