Search code examples
passwordspassword-storage

How to store a user's password to another web application

I'm building a web application that shows users interesting visualizations of their Gmail activity (who they're emailing the most, etc). Obviously the user needs to give me his Gmail password to use the application, and I'm wondering how I should store it:

  1. Store the Gmail password in plaintext. Risky!
  2. Don't store the Gmail password at all; force the user to enter it every time he wants to sync data. Potentially inconvenient!
  3. Encrypt the Gmail password before storing it. The user's password to my application is the key.

Something like (3) seems best, but with (3) I can only sync data when the user logs in (since I won't know his password to my application at any other time), which isn't ideal. I'd prefer a Mint.com-like solution whereby the user can click a button to sync data from Gmail at any time without re-entering his password (any idea how Mint accomplishes this without storing your banking passwords?)

Solution

  • As of 4 days ago (good timing!) Gmail supports OAuth for accessing message data through IMAP. This means your apps never needs to see users' passwords. The documentation includes libraries and sample code.