Storing Passwords

[mvallevand]

I want to add a live365 username and password, and was wondering if there is a standard spot for developers to store passwords that they don't want to see uploaded. It seems the config.xml and gbpvr.db3 are not the best place for this.

Martin

[psycik]

Don't see why config.xml shouldn't be used. I use it for the last.fm one in there, and just encrypt it. It's only decryptable by the program. I'm sure if could be brute force attacked but meh.

[reven]

personally i wouldnt use config.xml, that couldnt be uploaded to thsi forum for support. and im assuming your plugin/whatever will be able to decryot this password. and then anyone with access to the source, or using reflector to see the source (which is insanely easy to do) could get a users password. this password might be used for multiple things, and yeah it could be out there on the net.

id probably encrypt it and put it in the registry.

[whurlston]

If the passwords are for websites, you could have the user log into the website with the "remember me" option checked and then have your WebClient() read/import the cookie information. That's what I did with the Netflix plugin.

[mvallevand]

For me config.xml isn't the place for remote passwords and the registry isn't appealing because as I add more on line services it becomes riskier because I figure most people don't back it up.

The password is for the stream so they will typically either use a cookie on an api or web service to login. I probably need a custom solution.

Martin

[whurlston]

Why not store them in your own XML configuration file?

[mvallevand]

I'm going to, I was looking to see what others were doing. If developers had a common datastore for config values we don't want uploaded, I thought it might be easier. We might have been able to come up with a common secure way of doing this so we can't even open the file.

My challenge now is coming up with a way to do this that is also user specific, since GBPVR users voted to keep all data in the Program Files folder.

Martin

[whurlston]

You can encrypt the XML file. The mce epg data was done like that. My mce2epgxml project source shows how to read an encrypted XML file. Some slight modications to the code could write an encrypted XML.

[reven]

you may want to use a machine specific key to do the encryption, so if they do post the file to this forum for example, no one can decrypt the username/password unless they are on the users machine (or know the key for the machine)

[mvallevand]

It think that using DPAPI with the CRYPTPROTECT_LOCAL_MACHINE flag will be safe enough for the things I want to do, the trouble is going to be keeping this info from Logger.Verbose()

Martin