Secure (transient) storage of passwords for external APIs that don't support OAuth

My latest project, OboxApps.com, a mobile app suite for LogicBoxes (LB) and Resellerclub (RClub) users, has to deal with the the awkward situation of storing the users credentials to make API calls on their behalf.

Searching turned up some great answers by ircmaxell on how to deal with situations like this:

1. PHP 2-way encryption: I need to store passwords that can be retrieved
2. Encoding cookies so they cannot be spoofed or read etc

For increased security, I wanted the storage to be transient (duration of the session) and did not want to store the password on the server. So this is what I came up with:

• I ask the user for the API credentials over HTTPS.
• Verify that the creds works by making an API call.
• Generate a 128 character random salt.
• Encrypt the password using the random salt with the method used in the Encryption class from answer 1 above.
• Store the random salt and API username in the session.
• Send the encrypted password to the client in a secure (HTTPS), httponly cookie.

The API credentials and the encrypted password cookie are transmitted over HTTPS to protect against any kind of sniffing and the httponly property of the encrypted password cookie ensures that client side JavaScript cannot access it through XSS attacks (although it is not supported by all browsers).

Additionally (as suggested by ircmaxell in a private conversation), I could also look at implementing the Secure Cookie Protocol (pdf) for the encrypted password cookie and ensure the salt is sufficiently strong by using a derivation function such as KDF3 on the random salt to prevent or at least curb brute force attacks against the key generator, but I think this is good enough for now.

Owe.to Facebook Application

I created the Owe.to Facebook Application over the weekend to skip the email address verification step (that was required to prevent others from pretending to be you). I can skip it in the Facebook application because Facebook has already verified your email address.

Go to App or check out the Application Profile Page.

You will be asked for the send me email permission when you access the app for the first time. Owe.to requires this permission to access your Facebook verified email address.

Would love to get feedback form you. Please leave a comment below or visit http://oweto.uservoice.com/

Owe.to Update: Group Reminders, Remember Email Verification Status and Sneak Peak of Android App

Here is a quick update on Owe.to:

• Group Reminders: You can now setup reminders for more than one person by simply filling in additional email addresses separated by commas. This is perfect for keeping track of shared expenses like parties and celebrations, going clubbing, group holidays or buying a gift for special events like a friend's birthday, wedding, housewarming or baby shower.
• Remember Email Verification Status: If you are a regular user of Owe.to, then you won't have to verify your email address every time you want to setup a reminder. When you verify your email address by clicking on the link sent in the verification email, it will remember the verification status for your email address and won't ask you for verification for all subsequent requests in the same browser. 

I've tried to implement these without sacrificing the immediacy and simplicity of Owe.to. Hope you like it. To give feedback to improve Owe.to visit: http://oweto.uservoice.com/

Coming soon: My friend Mital is working on an Android app for Owe.to.

Owe.to (my "little" app) featured in The Times of India's Mumbai Mirror

I woke up on Feb 9, 2011, to see a lot of users on Owe.to. Ok, a lot is not really a lot, more like a few hundreds, but it was more than the usual, considering I hadn't announced it anywhere and only showed it to few friends.

Looking at the access logs, I stumbled upon a few requests coming in from the online version of The Times of India's Mumbai Mirror. Turns out that someone at Mumbai Mirror came across Owe.to and featured it on Page 24 (the sci-tech section).

The reason I hadn't announced it yet was because I was still wrapping up the finishing touches on it (lots of small things to do). This forced launch had me scrambling to finish off stuff, but it was also kind of liberating and exciting. Plus I now have a nice pitch for Owe.to thanks to the description in the paper:

Fed up of friends who borrow money and then conveniently forget? A website to send friendly automated email payment reminders to them.

Other places Owe.to has been spoted so far:

• Jared Spool bookmarked my now dated post about Owe.to's design principles alongside Dieter Rams: ten principles for good design, Facebook Design Principles and LukeW's Developing Design Principles:  http://www.delicious.com/jmspool/designprinciples
• Stephen Anderson said "(Owe.to is a) Great example (of a conversational form), thought through in detail"
• Owe.to was featured on a Dutch website in an article about conversational forms: http://www.webanalisten.nl/verbeteren/praktijk-cases/%E2%80%9Cverhaal-formulieren%E2%80%9D-ruim-25-meer-conversie.html

4 things the MacBook Pro gets right

I've been using a MacBook Pro for a while now, and while I still prefer Linux over OS X (with the exception of  Safe Sleep), here are 4 things I love about the hardware:

• Backlit island-style/chiclet keyboard that is very comfortable and an absolute saviour  when working at night and in low-light situations.
• Large trackpad that is a joy to use.
• MagSafe, the magnetic power connector, which has saved the laptop a couple of times from serious damage.
• The nifty external battery indicator.

Stop Dreaming, Start Doing.

Dreaming up stuff is fun, but it does not count for anything, if you only stop at that. Inaction is the surest way to fail. That's kind of obvious; I know, so why then do we still dream about success, and yet not start?

Luck has a big part to play in ideas succeeding, and you're only as lucky as the number of ideas you've tried. So it's not just the "doing stuff", but the "doing LOTS of stuff" that really matters when your looking for those few ideas that will eventually succeed.

Oh, and when your doing lots of stuff, expect a lot of them to fail.