问题
I'm writing a QML client for a service that needs authentication with a username and password. At the moment I am using a c++ plugin to encrypt and decrypt the password, but I'd like to replace that with plain QML to avoid the platform-specific binary.
Not an option:
- hard-coding an encryption key (since that could be extracted from the package)
- hashing (since I need to be able to recover the password in plain-text)
- security by obscurity (obviously)
回答1:
There is this type of question from time to time (just search the stackoverflow) and - basically once the data/code reside on the client's side, the client will be able to access them. You can just make it more difficult. (I know you hoped for another answer, but based on your question you've figured it out that placing the "Not an option" requirements, you ran out of options)
Many answers suggest using credential vault services, but you need to have the service credentials somewhere on the client's side too.
(just search how much money invest some companies in DRM and how long it stay unbroken)
Indeed you could encrypt / hide the credentials somewhere, but you need to have the location and decryption key available. According to my experience most of the users will give up once the credentials in the configuration are not plaintext, but it is difficult to stop a "dedicated user".
At the end - IMHO the best you could do with limited time/budget is hide/encrypt the credentials to get them out of plain sight :(
回答2:
If you want to encrypt / decrypt something - and it seems to do - then you will have to store or calculate the secret key somewhere.
Using a system-protected store would be an option, possibly backed up by a TPM. You could also ask for a separate password at startup to create your own key store. Storing the password in a config file could be an option if you just want to provide it during integration rather than during coding.
In the end, you'll need a key to decrypt. You cannot just use another key to decrypt the decryption key as you would have the same issue: protecting the key. So you do need to look outside your own application to solve the issue; some kind of input or resource is required.
来源：https://stackoverflow.com/questions/48840717/store-and-encrypt-a-password-locally