如何实现仅登录程序可读取、外部无法访问的密码存储文件？

Great question—storing plaintext usernames and passwords in an easily accessible text file is a major security red flag, and there are several robust approaches to fix this so only your application can access the credentials. Let’s break down the most effective solutions:

1. Lock Down File System Permissions (First Line of Defense) #

Even before encryption, you should restrict who can read/write the credential file using OS-level permissions:

• Windows: Use Access Control Lists (ACLs) to grant full access only to the user running your app and the local system account. Remove all permissions for other users, including "Everyone". You can set this programmatically via the Win32 API or using icacls commands in your installer/setup.
• macOS/Linux: Set the file permissions to 600 (read/write only for the owner) using chmod 600 /path/to/credential.file. Store the file in your app's private directory (like ~/.config/your-app-name/ on Linux, ~/Library/Application Support/your-app-name/ on macOS) which already has restricted access by default.

⚠️ Note: This alone isn't foolproof—administrators/root users can still bypass these permissions. Pair this with encryption for full security.

2. Encrypt the Credential Data (Critical for Sensitive Info) #

Never store plaintext credentials. Instead, encrypt the username/password pair before writing to the file, and only decrypt it when your app needs to use it:

• Use Symmetric Encryption: AES-256 is the gold standard here. The key challenge is safely storing the encryption key:
  • Leverage OS Security Modules: Use platform-specific tools to store the key securely:
    • Windows: Data Protection API (DPAPI) – encrypts data tied to the user's account or machine, so only that user can decrypt it.
    • macOS: Keychain Services – stores encryption keys (or even the credentials directly) in the system keychain, which requires user authorization or app-specific access.
    • Linux: libsecret/Secret Service API – integrates with desktop keyrings like GNOME Keyring or KWallet.
  • Derive a Key from User Input: If you don't want to rely on OS tools, derive an encryption key from the user's master password using a slow hashing algorithm like PBKDF2, Argon2, or bcrypt. This way, only users who know their master password can decrypt the stored credentials.
• Add Tamper Protection: Include a HMAC (Hash-Based Message Authentication Code) alongside the encrypted data to verify that the file hasn't been modified by external parties.

3. Use OS-Built-In Credential Managers (Best Practice) #

Instead of rolling your own file-based storage, use the operating system's native credential management system. These are designed specifically for secure storage and handle permissions/encryption automatically:

• Windows: Credential Manager – store credentials as "Generic Credentials" tied to your app's unique identifier.
• macOS: Keychain Access – create an app-specific keychain entry that only your app can access (you can set access restrictions via the Keychain API).
• Linux: Secret Service – store credentials in the system or user keyring, with access limited to your app.

This approach eliminates the need to manage file permissions or encryption yourself, as the OS handles all the heavy lifting securely.

Avoid These Common Mistakes #

• ❌ Never hardcode encryption keys in your app's binary—attackers can reverse-engineer the code to extract them.
• ❌ Don't use weak encryption algorithms (like DES or 3DES) or insecure modes (like ECB). Stick to AES-GCM or AES-CBC with proper IV handling.
• ❌ Don't store credentials in easily discoverable locations (like the user's Documents folder or the app's installation directory). Use the OS's recommended private app directories.

内容的提问来源于stack exchange，提问作者Ashiente Ani