Search code examples
javasecuritypasswords

Securely store user account details required for use in code


I am building an application that interacts with a web service. In order to use that web service I have to login using my actual username and password - there is no other way to use the service.

I do not want to hard code in my details, like so:

String username = "MyUsername";
String password = "MyPassword";

I have thought about encrypting the details and storing them in a file, but, even so, anyone who has some programming experience can easily recover the information by looking at my source code:

File f = load("mydetails.txt");
String[] = recoverDetails(f); //or something like that

What is the safest way for me to store this information?


Solution

  • If you really want them to be safe, you're going to have to lock them into a cryptographically secure "vault" file. Somebody — you or somebody trusted, however that's appropriate here — would provide a key to unlock the vault (basically another password), and then your software would be able to access the information stored in it.

    If there is no human with a secret involved in starting the application, then there's really not going to be any way to totally hide the information. This is just a simple fact of reality, one that many people (like the DVD consortium) struggle to deny at their own peril.