When developing login module for a web application, do you suggest to keep the username and password in a keystore? Lets assume the keystore was kept in a very safe place in web server.
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
It's never a good idea to store passwords on the server anywhere, keystore or otherwise. It doesn't matter how safe you intend to keep the passwords -- you are still storing them somewhere, which introduces a set of possible vulnerabilities which are completely avoidable.
You should either be offloading the login process to an external provider (for exmaple, OpenID) or you should only be storing is password hashes (and associated salts). That way even if your server is compromised, the passwords would not be available without some brute force password cracking software (which still won't get strong passwords -- and won't get many weaker ones if you use a good password hashing algorithm like BCrypt).
As for where to store the password hashes, it doesn't really matter as long as it's meets your specifications for permanence and performance. Most people use a typical database to store these, but a simple key-value store (with permanence) would be fine for most applications.