[SOLVED] Encrypting (or protecting) a Python password

Question

I have a script which accesses my Facebook and lets me know when I have notifications, etc.  However, within the script, my password is currently in plain-text; I see this as a security flaw for obvious reasons.  After Google searching, I couldn't really find a solid answer on encryption methods for passwords in a situation like this, and, to be honest, I know very little about cryptography. 
I was hoping to get some ideas, solutions, or confirmation of existing solutions, for keeping my password safe and accessible to my script; it would be nice to hear from someone with working knowledge on the subject, but any and all help would be appreciated.
http://stackoverflow.com/questions/1020 … pt-decrypt
http://stackoverflow.com/questions/1867 … encryption
Last edited by apolyonn (2014-03-16 16:29:16)

Answer 1

Then you're probably fine.
Your post #5 has a few extra questions in it I want to clarify, since I kind of ignored them earlier:
apolyonn wrote:For instance, when phone applications (ie, Facebook App) store your credentials, are they storing it with secure protection methods; if not, why are they used without question -- and without being exploited en masse?  Also, I've heard a lot of good things about GPG, as x33a suggested; but, if this type of encryption is useless, then I must ask what the difference is between "client-side encryption" and encryption in general, and if either will really protect information.
I have no idea how Facebook App (or any other app) stores passwords. But, even if an app stores passwords in plain text, an attacker still has to gain read access to your individual phone in order to actually *read* them. Plain text passwords are as secure as the device they're stored on; encrypted passwords are as secure as the device the decryption key is stored on. When an encrypted password is stored alongside its own decryption key, it might as well be stored in plain text. I hope this kind of addresses the question of why plain text passwords aren't susceptible to mass exploitation (or, at least, why they're no more susceptible than encrypted passwords).
But encryption in storage (I said "client-side" earlier) is different from the issue of in transit encryption, which is what prevents an attacker from snooping on passwords being sent through unsafe channels (such as open Wi-Fi networks, or any network not owned by someone you absolutely trust). Facebook probably uses HTTPS for this purpose, and that's what encrypts your credentials whenever they're actually being sent across the Internet. What makes it safe is that only Facebook has the private key that can decrypt your HTTPS messages.
GPG used correctly is similar to HTTPS: strong encryption, beyond kid-sister level. (At least until D-Wave or somebody makes a quantum computer capable of factoring large numbers quickly.) But encryption alone doesn't make your data safe; you must also keep secret the decryption keys.