I’m wondering how applications like Skype and Dropbox store access credentials securely on a user’s computer. I imagine the flow for doing this would look something like this:
- Prompt the user for a username/password if its the first time
- Acquire an access token using the user provided credentials
- Encrypt the token using a key which is just really a complex combination of some static parameters that the desktop application can generate deterministically. For example something like:
value = encrypt(data=token, key=[os_version]+[machine_uuid]+[username]+...)
valuein the keychain on OSX or Credential Manager on Windows.
- Decrypt the
tokenwhen the application needs it by generating the
So two questions:
- Is what I described remotely close to what a typical desktop application that needs to store user access tokens long term does?
- How can a scheme like this be secure? Presumably, any combination of parameters we use to generate the the
keycan also be generated by a piece of malware on the user’s computer. Do most applications just try to make this key as hard to generate as possible and keep their fingers crossed that no one guesses how it is generated?