{"action":"created","issue":{"url":"https://api.github.com/repos/VBA-tools/VBA-Web/issues/147","labels_url":"https://api.github.com/repos/VBA-tools/VBA-Web/issues/147/labels{/name}","comments_url":"https://api.github.com/repos/VBA-tools/VBA-Web/issues/147/comments","events_url":"https://api.github.com/repos/VBA-tools/VBA-Web/issues/147/events","html_url":"https://github.com/VBA-tools/VBA-Web/issues/147","id":98962177,"number":147,"title":"Encrypted Credentials","user":{"login":"Bazuum","id":7554914,"avatar_url":"https://avatars.githubusercontent.com/u/7554914?v=3","gravatar_id":"","url":"https://api.github.com/users/Bazuum","html_url":"https://github.com/Bazuum","followers_url":"https://api.github.com/users/Bazuum/followers","following_url":"https://api.github.com/users/Bazuum/following{/other_user}","gists_url":"https://api.github.com/users/Bazuum/gists{/gist_id}","starred_url":"https://api.github.com/users/Bazuum/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Bazuum/subscriptions","organizations_url":"https://api.github.com/users/Bazuum/orgs","repos_url":"https://api.github.com/users/Bazuum/repos","events_url":"https://api.github.com/users/Bazuum/events{/privacy}","received_events_url":"https://api.github.com/users/Bazuum/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-04T12:57:23Z","updated_at":"2015-08-04T15:02:33Z","closed_at":"2015-08-04T15:02:33Z","body":"Hi,\r\nIam using \"HttpBasicAuthenticator\" to connect to a Rest-API.\r\nTherefore, the username and password is decrypted in the sourcecode.\r\nSame with credentials for the Proxy. Decrypted IP, Username and password here too.\r\n\r\nAm i doing something wrong or is it normal to write passwords without encryption in the source code?"},"comment":{"url":"https://api.github.com/repos/VBA-tools/VBA-Web/issues/comments/127642704","html_url":"https://github.com/VBA-tools/VBA-Web/issues/147#issuecomment-127642704","issue_url":"https://api.github.com/repos/VBA-tools/VBA-Web/issues/147","id":127642704,"user":{"login":"timhall","id":1211148,"avatar_url":"https://avatars.githubusercontent.com/u/1211148?v=3","gravatar_id":"","url":"https://api.github.com/users/timhall","html_url":"https://github.com/timhall","followers_url":"https://api.github.com/users/timhall/followers","following_url":"https://api.github.com/users/timhall/following{/other_user}","gists_url":"https://api.github.com/users/timhall/gists{/gist_id}","starred_url":"https://api.github.com/users/timhall/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timhall/subscriptions","organizations_url":"https://api.github.com/users/timhall/orgs","repos_url":"https://api.github.com/users/timhall/repos","events_url":"https://api.github.com/users/timhall/events{/privacy}","received_events_url":"https://api.github.com/users/timhall/received_events","type":"User","site_admin":false},"created_at":"2015-08-04T15:02:33Z","updated_at":"2015-08-04T15:02:33Z","body":"@Bazuum the most secure method would be to not store the password at all and have the user enter the password in a userform with a password field. I personally keep them out of the workbooks in a separate txt file so that I don't accidentally check them in to Github, but this is probably the least secure method so I wouldn't necessarily recommend it. Another option along the same lines is to store them in environment variables on trusted computers and then load them via `Environ` in VBA. There are some encryption functions available to VBA so you could store encrypted passwords and decrypt with a user-supplied key, but I don't have experience with this and haven't found any tutorials on securely doing this. As for proxy credentials, you may be able to use `Client.EnableAutoProxy` so that they are loaded automatically from the system so that there is one less password to store. Generally, I would try to keep passwords out of Workbooks/VBA.\r\n\r\nPassword field:\r\nhttps://support.microsoft.com/en-us/kb/830258\r\n\r\nHere are some links to other approaches:\r\nhttp://programmers.stackexchange.com/questions/147254/security-concerns-with-password-storage-in-scripting-languages-vba\r\nhttp://stackoverflow.com/questions/3217014/how-to-securely-store-connection-string-details-in-vba\r\n\r\nThis seems like a secure and interesting approach, but it's pretty labor intensive:\r\nhttp://vba4all.com/how-to-securely-store-my-connection-string/\r\n\r\nPossible encryption route:\r\n(I previously used System.Security.Cryptography for hashing and it appears there are methods available for AES encryption/decryption, so an approach like the following might work)\r\nhttps://github.com/VBA-tools/VBA-Web/blob/fd24a0b898cca2e50ac53e105306e7f167fbb9b0/src/RestHelpers.bas#L1054\r\nhttps://msdn.microsoft.com/en-us/library/System.Security.Cryptography%28v=vs.110%29.aspx"}}