Search code examples
passwordspassword-encryptiongnupg

how to store a password in webapp that needs to be passed in plain text to a third party?

I have a simple webapp which users login to access to a third party API that also require their personal credential in plain text username and password (no OAuth or anything). What's a proper, safe-ish, and straightforward way to store these third-party passwords so I can decrypt them to plain text when needed and minimise leakage of these passwords?

I'm thinking of just hardcoding GPG keys in to encrypt in webapp for storage and decrypt from another machine behind firewall when needed.

Solution

  • I don't think this is a GPG-specific problem. You could think of a scheme like the following (no need for public key crypto):

    1. Generate a random password to encrypt the plaintext credentials you want to protect
    2. Derive a key to protect this random password from the user's password
    3. Encrypt the password from step 1 with the password from step 2

    Now you can access the protected credentials after the user has logged in (since you know the password the user entered). When the user changes his password, you only have to re-encrypt the key from step 1 (in case you use this key in multiple places; so you can't miss one).

    For step 2, you should use some (slow) key derivation function like PBKDF2. This makes sure that in case of a security breach, a simple dictionary attack on the encrypted credentials is not possible.