How to avoid storing usernames and passwords in plaintext?

Question

I am currently working on a project that involved interacting with third-party websites that use basic HTTP auth.

With Python, I can use the requests module, along with a auth variable to pass the username and password along with the request.

Now the problem is, if someone else wants to use this, they need to store their password and username in plain-text as a variable in my Python script.

Now obviously, this is a huge security flaw, if I got hacked and my files were dumped, potentially hundreds of usernames and passwords would be leaked.

Now onto my question, I need to pass plain-text passwords in the request as that is all the website will accept.

However I would prefer to not store them locally. Python has numerous encryption and decryption modules, ones that could be used to decrypt the password before sending the request.

However, if someone gained access to the file, they could just run the script (after adding the required modules), and they would be able to get the password.

I am very new to web development, so what is the best way for me to avoid storing plain-text usernames and passwords, while still being able to send plain-text passwords in the request?

@chris85 You have a point there! Will, remove the "username" from your next Google query.. — Xorifelse, Nov 17 '16 at 00:54
Possible duplicate of [Correct way to store passwords in PHP](http://stackoverflow.com/questions/34409997/correct-way-to-store-passwords-in-php) — r3mainer, Nov 17 '16 at 01:58
@squeamishossifrage Read their question again. What you posted doesn't apply as a possible duplicate. Read the last paragraph in the question. — Funk Forty Niner, Nov 17 '16 at 02:08
@Fred-ii- OK, point taken. Although this really isn't a new problem. SSL and bcrypt work just fine; there's no need to invent any new solutions. — r3mainer, Nov 17 '16 at 02:40
If you encrypt the password (not a good idea) that is just moving the problem to keeping the key available and secret. — zaph, Nov 17 '16 at 02:49
I know about SSL, I use it where possible. I mean if someone got the actual file containing it — Will, Nov 17 '16 at 06:10

How to avoid storing usernames and passwords in plaintext?

0 Answers0