I am building an web site which will allow users to aggregate the information stored in their online profiles ("data feeds") in one place.
I am wondering - what is the accepted (from a secureness point of view) way to store user name / password information in a my database?
Normally I would derive a salted-hash value from a password and would store this, but that obviously would not work in this case, as "data feeds" websites would need an actual password.
Storing the credentials it in a clear text is not an option, as it would be a huge security risk.
Not storing passwords in a database, asking users to type them in at the beginning of each session and then keeping them in a in-session memory does not seem like a viable option either, as it would be too much trouble for users to enter the same passwords many times again and again.
So far it seems that the only option is to encrypt passwords somehow, but I don't know what are the best design patters for such option.
Or perhaps there is way to deal with that problem, I haven't even considered ...
What would you recommend?