How to store a password for a desktop client?

3 years ago by TheCee to c/ask_experienced_devs

Hi, by now it seems to be common knowledge that passwords shouldn't be stored in a database. Backend devs generally know to hash and salt and what-not their transmitted passwords. It seems to be well documented.

However, I wasn't exactly able to find such a clear answer for client applications accessing e.g. web APIs. For example, lets assume you were to create a Lemmy desktop application with support for multiple accounts. Ideally, that software would work like a password manager and store its master password as hash only.

However(2), sometimes users like to start said application without entering their password. Like an Email client in pleb mode. Which requires the passwords to be stored somewhere. In this case, what is the best course of action?

yogsototh 7 points 3 years ago

Ideally you should use the help from the OS. For example if you target Apple they provide this keychain API made for that.

https://developer.apple.com/...

But looking I found this apparently portable lib https://github.com/hrantzsch/keychain

path: 0 1977196, hotness: undefined, score: 7, children: 6

solidsnail 5 points 3 years ago

For Linux there's gnome keyring.

path: 0 1977196 1977197, hotness: undefined, score: 5, children: 3

superkret 2 points 3 years ago

path: 0 1977196 1977197 1977407, hotness: undefined, score: 2, children: 2

Trivial 2 points 3 years ago

It has no dependency on a specific DE.

path: 0 1977196 1977197 1977407 2042980, hotness: undefined, score: 2, children: 0

gamma 2 points 3 years ago

keyctl then

path: 0 1977196 1977197 1977407 2042434, hotness: undefined, score: 2, children: 0

Lucky 2 points 3 years ago

Windows credential manager is also an option baked into the OS, though I don't have experience working with it to say how good or bad it is

path: 0 1977196 2040129, hotness: undefined, score: 2, children: 0

tun 1 point 3 years ago

https://code.visualstudio.com/...

This shows how MS Visual Code stores the password in keychain in various OSes.

path: 0 1977196 3449372, hotness: undefined, score: 1, children: 0

pileghoff 5 points 3 years ago

I think most applications store it in plain text, but makes sure the file is only readable by the current user. This way, we rely on the protection of the OS, instead of doing it ourselves. (I'm not a desktop app developer, so I might be completely wrong, but I think this is what e.g. Firefox does).

path: 0 1971960, hotness: undefined, score: 5, children: 1

GJdan 5 points 3 years ago

Yeah it's not too rare to store passwords in config files (e.g ~/.config/appname/config.json) usually at least base64 encoded to support special characters. It is usually better to try and store a token instead as they can be revoked or expired. If you have to store a password it might be fun to look into storing it in the system keychain, at least for macos or Linux, not sure if Windows has a keychain.

path: 0 1971960 1973053, hotness: undefined, score: 5, children: 0

canpolat 5 points 3 years ago

As far as I know, the correct way of handling authentication for a desktop applications is using OAuth and "Authentication Code with PKCE" flow. This way, you won't have to store the password at all.

But Lemmy doesn't support OAuth as of now. So, if you want users to be able to use the application without entering credentials, you will have two options:

Store the password under current user
Store the token you receive after the login (the token doesn't expire)

Lemmy may decide to expire tokens in the future (that's the correct thing to do, in my opinion).

path: 0 1972504, hotness: undefined, score: 5, children: 0

Dark_Arc 3 points 3 years ago

Pretty much every OS has some solution to this called a keyring, e.g.:

These can be used to basically delegate that job to somebody else. They typically work by protecting the keyring contents with the user's system credentials.

path: 0 3449843, hotness: undefined, score: 3, children: 1

TheCee 1 point 3 years ago

Thanks!

path: 0 3449843 3452006, hotness: undefined, score: 1, children: 0

0x0 2 points 3 years ago

You can password-protect a SQLite database, although you'd have to store the password within the app which raises other issues.

path: 0 2109529, hotness: undefined, score: 2, children: 1

TheCee 1 point 3 years ago

Yes, every approach seems to be limited in that an attacker could steal the password or token indirectly. So the safest bet is probably making storing passwords opt-in for each user.

path: 0 2109529 2111830, hotness: undefined, score: 1, children: 0

philluminati 2 points 3 years ago

You deskktop app could login to Lemmy via the web app and store the login cookie as it's token for future access. This security is effectively on-par with the existing web app in terms of what happens if the machine falls into bad hands.

But the same thing via an API would be preferred.

The idea that you can login to a website and get a cookie that last 3 weeks may feel absurd, but when you think about clients keeping unencrypted passwords it sort of makes it more appealing comparitively. Especially if you can lock down the cookie to the hardware to prevent theft somehow.

path: 0 2265865, hotness: undefined, score: 2, children: 0

ask_experienced_devs

ask_experienced_devs

@programming.dev

login for more options

Icon base by Delapouite under CC BY 3.0 with modifications to add a gradient

go to feed...

ask_experienced_devs

ask_experienced_devs

@programming.dev

login for more options

Icon base by Delapouite under CC BY 3.0 with modifications to add a gradient

go to feed...