I need to securely store a username and password in Python, what are my options? [closed]

by

The python keyring library integrates with the CryptProtectData API on Windows (along with relevant API’s on Mac and Linux) which encrypts data with the user’s logon credentials.

Simple usage:

import keyring

# the service is just a namespace for your app
service_id = 'IM_YOUR_APP!'

keyring.set_password(service_id, 'dustin', 'my secret password')
password = keyring.get_password(service_id, 'dustin') # retrieve password

Usage if you want to store the username on the keyring:

import keyring

MAGIC_USERNAME_KEY = 'im_the_magic_username_key'

# the service is just a namespace for your app
service_id = 'IM_YOUR_APP!'  

username="dustin"

# save password
keyring.set_password(service_id, username, "password")

# optionally, abuse `set_password` to save username onto keyring
# we're just using some known magic string in the username field
keyring.set_password(service_id, MAGIC_USERNAME_KEY, username)

Later to get your info from the keyring

# again, abusing `get_password` to get the username.
# after all, the keyring is just a key-value store
username = keyring.get_password(service_id, MAGIC_USERNAME_KEY)
password = keyring.get_password(service_id, username)

Items are encrypted with the user’s operating system credentials, thus other applications running in your user account would be able to access the password.

To obscure that vulnerability a bit you could encrypt/obfuscate the password in some manner before storing it on the keyring. Of course, anyone who was targeting your script would just be able to look at the source and figure out how to unencrypt/unobfuscate the password, but you’d at least prevent some application vacuuming up all passwords in the vault and getting yours as well.

More Related Contents:

  1. Encrypted and secure docker containers
  2. What’s the purpose of Django setting ‘SECRET_KEY’?
  3. Encrypting and decrypting a password raises ValueError
  4. Encrypt a Library Linux
  5. python building coder for ceasar cipher
  6. What are the risks of running ‘sudo pip’?
  7. Security of Python’s eval() on untrusted strings?
  8. Simple way to encode a string according to a password?
  9. Encrypt & Decrypt using PyCrypto AES 256
  10. hash function in Python 3.3 returns different results between sessions
  11. How to decrypt OpenSSL AES-encrypted files in Python?
  12. Is distributing python source code in Docker secure?
  13. How do I encrypt and decrypt a string in python?
  14. Hiding a password in a python script (insecure obfuscation only)
  15. Change to sudo user within a python script
  16. Securely Erasing Password in Memory (Python)
  17. Remove ‘b’ character do in front of a string literal in Python 3 [duplicate]
  18. RSA encryption and decryption in Python
  19. Python 3, Are there any known security holes in ast.literal_eval(node_or_string)?
  20. Mark data as sensitive in python
  21. Is a SQLAlchemy query vulnerable to injection attacks?
  22. Encrypt and decrypt using PyCrypto AES-256
  23. Is this Python code vulnerable to SQL injection? (SQLite3)
  24. Create a temporary FIFO (named pipe) in Python?
  25. Securely storing passwords for use in python script [duplicate]
  26. Google Authenticator implementation in Python
  27. Do CSRF attacks apply to API’s?
  28. What (pure) Python library to use for AES 256 encryption? [closed]
  29. How to do PGP in Python (generate keys, encrypt/decrypt)
  30. How to encrypt text with a password in python?

Leave a Comment