Hi, by now it seems to be common knowledge that passwords shouldn’t be stored in a database. Backend devs generally know to hash and salt and what-not their transmitted passwords. It seems to be well documented.
However, I wasn’t exactly able to find such a clear answer for client applications accessing e.g. web APIs. For example, lets assume you were to create a Lemmy desktop application with support for multiple accounts. Ideally, that software would work like a password manager and store its master password as hash only.
However(2), sometimes users like to start said application without entering their password. Like an Email client in pleb mode. Which requires the passwords to be stored somewhere. In this case, what is the best course of action?
Ideally you should use the help from the OS. For example if you target Apple they provide this keychain API made for that.
https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/storing_keys_in_the_keychain
But looking I found this apparently portable lib https://github.com/hrantzsch/keychain
Windows and Linux do not appear to provide as much security as macOS but this lib appear to do its best.
For Linux there’s gnome keyring.
frowns in wm
It has no dependency on a specific DE.
keyctlthenWindows credential manager is also an option baked into the OS, though I don’t have experience working with it to say how good or bad it is
https://code.visualstudio.com/docs/editor/settings-sync#_troubleshooting-keychain-issues
This shows how MS Visual Code stores the password in keychain in various OSes.