Secure location to store this info?

[motionman95]

I'm building an app that will upload files to a server. Currently, however when the user inputs their info (username, password, etc) I need to have a secure place to store them on the PC. I wouldn't won't the wrong type of people of virus prying into it.

Thanks!

[SpookMeister]

You can use _StringEncrypt to do a decent job of obfuscating the information, either write the encrypted info to an .ini file, or the registry depending on which is more appropriate to your application.

Tip: Don't call the entries username / password or whatever, use names like data1 data2 etc instead... won't fool everyone, but it adds another small level of "protection"... if you want true security... dont store the information at all, make the user input it every time.

Edited February 9, 2009 by SpookMeister

[Xand3r]

You can use _StringEncrypt to do a decent job of obfuscating the information, either write the encrypted info to an .ini file, or the registry depending on which is more appropriate to your application.

Tip: Don't call the entries username / password or whatever, use names like data1 data2 etc instead... won't fool everyone, but it adds another small level of "protection"... if you want true security... dont store the information at all, make the user input it every time.

like that is safe..

the safest way possible is not to store the password or an encrypted form of the password... and even writing it down every time isn't very safe

what you should do is.. remember the username either encrypted or not and a hash of the password (not oly the password though... something like hash($password&$username) ) oh and the part about data1,data2 is a good ideea

[SpookMeister]

like that is safe..

I don't think I said it was safe... it is just better than storing non-encrypted data of that nature.

@OP If you store the info anywhere on the system, then it is something that someone else can monitor. If you must store the information, then the best you can do is disguise it as best you can. Personally I think that the _StringEncrypt method is effective enough for most situations. If you are talking government security, or high level business secrets then frankly you should already have better methods available to you.

[James]

Something I like to do is _StringEncrypt the data, reverse the string and encrypt it again.

[motionman95]

Well, looks like I'll be using _StringEncrypt!