How to store user/pass securely in the browser?
simonw: If you can convince the third party site to adopt OAuth, do that.Otherwise, one technique you could use is to encrypt their password using a key derived from a hash of the password they enter. When they log in, set that hash as their cookie. Each time you need to use the third party password, read that cookie and use it to decrypt the stored password.Since you don't know their real password for your own app (as you only store a different hash of it), you won't be able to derive the hash used for the decryption process (note that this means you need to store a hash of their password for your own authentication using a different salt from the one you use to protect their encryption).With this technique, having access to your database is not enough to decrypt their third-party password.Unfortunately none of this resolves the root problem. Firstly, by asking users to trust you with their passwords for other sites you are teaching them to be phished. Secondly, if you turn evil (or someone evil acquires your site in some way) the server-side logic can be changed to steal the user's password.