# Secure password storage **URL:** \ **Category:** Rails\ **Created:** [August 11, 2008, 12:13am UTC](https://www.ruby-forum.com/t/secure-password-storage/145502 "2008-08-11T00:13:58Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Jonathan\_Huizingh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/7ea924/32.png) [@Jonathan\_Huizingh](https://www.ruby-forum.com/u/Jonathan_Huizingh)\ **Post date:** [August 11, 2008, 12:13am UTC](https://www.ruby-forum.com/t/secure-password-storage/145502/1 "2008-08-11T00:13:58Z")
I am working on a project that needs to store the user’s login credentials for multiple other sites so that I can go and grab information for them. I am trying to figure out how to do this securely, but still make this fairly simple for the user. Here’s what I have come up with so far: -Store the username and password of the remote system by encrypting them using a two-way encryption algorithm. -Use a passphrase defined by the user as part of the encryption process. -The same passphrase will be used for all of their credentials for all the different sites. -The user will enter their passphrase in each time they want to use the functionality that logs in at different sites. The passphrase will not be stored in my system. Does this approach seem reasonable? Is there anything important I am overlooking that would make this system crackable? If this system would work, which ruby packages would you suggest to do the encryption? Thanks, Jonathan ---
**Author:** ![Jonathan\_Huizingh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/7ea924/32.png) [@Jonathan\_Huizingh](https://www.ruby-forum.com/u/Jonathan_Huizingh)\ **Post date:** [August 11, 2008, 1:28am UTC](https://www.ruby-forum.com/t/secure-password-storage/145502/2 "2008-08-11T01:28:50Z")
On Aug 11, 12:13 am, “Jonathan Huizingh” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > the different sites. > -The user will enter their passphrase in each time they want to use > the functionality that logs in at different sites. The passphrase > will not be stored in my system. > > Does this approach seem reasonable? Is there anything important I am > overlooking that would make this system crackable? > > If this system would work, which ruby packages would you suggest to do > the encryption? I think it’s easier if you use salted password hashes. That’s probably more secure as well. I use this approach in all my applications. See [Storing Passwords - done right!](http://www.aspheute.com/english/20040105.asp) and [Salt (cryptography) - Wikipedia](http://en.wikipedia.org/wiki/Salt_(cryptography)) ---
**Author:** ![Jonathan\_Huizingh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/7ea924/32.png) [@Jonathan\_Huizingh](https://www.ruby-forum.com/u/Jonathan_Huizingh)\ **Post date:** [August 11, 2008, 4:27am UTC](https://www.ruby-forum.com/t/secure-password-storage/145502/3 "2008-08-11T04:27:44Z")
On Sun, Aug 10, 2008 at 4:01 PM, Hongli L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > -Use a passphrase defined by the user as part of the encryption process. > > the encryption? > > I think it’s easier if you use salted password hashes. That’s probably > more secure as well. I use this approach in all my applications. > See [Storing Passwords - done right!](http://www.aspheute.com/english/20040105.asp) and > [Salt (cryptography) - Wikipedia](http://en.wikipedia.org/wiki/Salt_(cryptography)) Salted hashes won’t work for the OP needs, since he needs to send the original plaintext password to another site. Anyways, for the OP, yeah, what you’re proposing in general should work. Honestly, if you keep on asking the user for a password, I’m not sure if there’s enough value in it. Depending on your threat model, it might be acceptable to keep the unencrypted passwords cached in memory on the server, so the user only has to unlock their keys once per session. Your best bet is probably to use the OpenSSL ruby library. I’d recommend using a symmetric key algorithm like AES. – Aaron T. [http://synfin.net/](http://synfin.net/) [http://tcpreplay.synfin.net/](http://tcpreplay.synfin.net/) - Pcap editing and replay tools for Unix & Windows They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety. – Benjamin Franklin ---
**Author:** ![Jonathan\_Huizingh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/7ea924/32.png) [@Jonathan\_Huizingh](https://www.ruby-forum.com/u/Jonathan_Huizingh)\ **Post date:** [August 11, 2008, 11:38am UTC](https://www.ruby-forum.com/t/secure-password-storage/145502/4 "2008-08-11T11:38:48Z")
On 11 Aug 2008, at 03:26, Aaron T. wrote: > Your best bet is probably to use the OpenSSL ruby library. I’d > recommend using a symmetric key algorithm like AES. The documentation for that is a bit terse (it sort of assumes you’re familiar the the C openssl library (the ruby stuff is a thin wrapper round it), but it will get the job done. Don’t forget to use filter\_parameter\_logging - would be a shame to go to all that effort and then dump the user’s master password in your log files. Fred