Storing username/password on Mac using Java

Question

I'm writing a small program (a twitter client) in Java, aimed at Mac OS X. As part of its functionality, it needs to have a place to store the twitter username/password. The natural place would be the mac keychain, but I can't find any way of accessing it.

Is there any way of accessing the mac keychain from Java, or failing that, what is your recommendation for where to store the username/password instead?

Clothesline

Answer 1

There is Java keychain API, in that there's an implementation of KeyStore on OS X backed by the keychain.

I think the keychain is the best place (if not the place) to store the password. It's encrypted with a good algorithm, the user is free to be as permissive or as paranoid over the availability of the keychain to apps as they like, and the password would then be stored with and configured like all of the other passwords the user stores.

Chorion

I like this better than Kevin's answer because sometimes you won't be writing a twitter client and you want the paranoid apple password warnings. Cancel or Allow. Cancel or Allow. (vista almost had it right) – Doodlesack

I like this one too, for the same reasons. – Impetrate

Has anyone tried this? I did and it seems that you can't store a SecretKey with apple.security.KeychainStore - see source code. – Soapbark

It's pretty, but it does not work. See mail.openjdk.java.net/pipermail/macosx-port-dev/2014-March/… for test code and RFE. – Puzzle

Answer 2

I haven't tried this, but it looks like you can access the key chain with the Apple crypto provider (com.apple.crypto.provider.Apple), creating a KeyStore of type KeychainStore.

---

Okay, after some experimentation, I was able to access private-key–certificate entries in the KeychainStore. However, passwords in my Keychain did not show up (no alias was listed), and when I tried to add a KeyStore.SecretKeyEntry (which is what you'd need to hold a password) it failed with the message, "Key is not a PrivateKey". Clearly, Apple has not supported SecretKeyEntry.

If you still want to protect your Twitter password through the key chain, I think the closest you can get is to generate an RSA key pair, self-sign a certificate, and add a PrivateKeyEntry to the keychain. Then you can use the key pair to protect the Twitter password.

It isn't terribly difficult to sign certificates yourself, but if you go that route, you might want to check out the BouncyCastle library for help.

Blythe

Indeed, it does not work. However, it works with JCEKS as KeyStore. For a rough example, see kingsfleet.blogspot.de/2008/12/… – Puzzle

@hendrik Yes, JCEKS has always supported SecretKeyEntry, but this question is specifically about using the "Keychain" feature of Mac OS. – Blythe

No sweat, just wanted to add some additional info and at the same time raised the issue on and Java OSX port list - who knows, perhaps it gets implemented at some point. – Puzzle

Answer 3

You should take a look at twitters API page on OAuth support. By using OAuth, you don't need to know the user's twitter password.

http://apiwiki.twitter.com/OAuth-FAQ

Impetrate

That's brilliant! I will have to look into it more, but it sounds like a much better solution than storing the passwords. – Clothesline

If it does, you'll get the best answer tick, obviously. – Clothesline

The recent openauth vulnerability & subsequent (temporary) disabling by Facebook and others may change how dependant on this mode of authentication you are. I would still suggest this as a preferred method of authentication, but you should think about how to authenticate (and store credentials) if openAuth is disabled again. – Impetrate