Java：简单的文本文件加密？

Question

I have the following three lines in my little game which store the id and pass of a new user:

Properties prop = new Properties();
prop.setProperty(id, pass);
prop.store(new FileOutputStream(new File("path/to/project/src/properties.data")), "");

Unfortunately I've noticed that only by changing the properties file extension to txt all the users and passwords become visible and readable by anybody, which is a thing I don't really like. Please let me know of a good easy method to encrypt the file in some way.

The thing is I already searched about this but the answers don't really fit my needs, I don't expect my game files getting attacked by the biggest hackers so using AES or any other big popular libraries would be too much I'd say. What do you think?

Answer 1

First, everybody can read your password file, no matter if the extension is .txt or .data or whatever else. The extension is just a Windows trick to decide with which program to open the file, but it does nothing to the contents.

If you want to encrypt the password file, you'll need a key and / or a password for that, and then you need to figure out where and how to store that. You just postpone the problem.

If the file holds names and passwords of the players in your game, go with @Boris the Spider's advice: instead of saving (encrypted) passwords, just save the password's hash. When someone logs in, calculate the hash of the entered password and compare that to the hash you have saved. If they are equal, the user entered the correct password. See this question and the accepted answer for a possible way to do this.

Answer 2

Here's an excellent article on storing passwords securely. The examples are in C#, not Java, but it's still a helpful discussion: https://blog.mking.io/password-security-best-practices-with-examples-in-csharp/

I also strongly recommend the book "24 Deadly Sins of Software Security" by Michael Howard and David LeBlanc as a more general overview of common security bugs and how to avoid them.

Answer 3

我遇到了类似的问题，我采取了在文件中写入AES加密字符串的方式（在我的情况下，要求用户从管理员那里获取加密密钥以放入属性文件中，因此我也提供了一种向其加密密码的方法），然后在我正在阅读的方法中将其解密。