Short version: I want "Login on program startup" checkbox like in Skype, for example, but don't know how to protect saved credentials securely.
I'm writing client application which, before doing actual requests to server, should be authorized by server. Authorization goes as follows: user fills in standard login dialog, data goes to server via HTTPS and, if it was correct, server sends credentials.
However, entering password each time is disturbing and prevents starting application on system startup. I want to encrypt those credentials and save them on disk. I could not find appropriate encryption key, however.
Key should be, obviously, user-specific (not system-wide!) and reasonably hard to fraud.
For now I just use hash of some HDD info and username and fallback to hash of process environment, if WinAPI call fails (how bad is that?).
I'm writing for Windows using C++/Qt, but any recommendation is welcomed. Thanks.
Ok, to make myself clear:
- Required encryption level is:
you cannot login by simply copying
credentials.datfile from one computer to other (or one user folder to other);
- Keeping password secure (which is not stored by application) is user's responsibility.
- I want to store not the password, but encrypted access token which is
public keyfor encrypting communications with server.
From your answers I've understood that my auth. system isn't okay. I will reconsider it. And yes, I have access to both, server- and client-side.
For now, I want way to determine machine- and user-unique encryption key, which I can get from OS in runtime to decrypt/encrypt credentials (which is server's answer to email/password entered by user).