Automated login and password storage

Question

I wrote a simple PHP script to log into my mobile phone provider's website, check my balance, and send me an email if it's too low. I put the script on a distant server.

It seems that I have to store my password as plaintext in the script to be able to send it to the login page. However, I am a little bit reluctant to do this...

$user="foo";
$password="blah";

Is there a more secure way?

Answer 1

You cannot secure a system which is capable of logging you in automatically if someone has access to the source. Let's try to prove it.

1. System Smart is able to log you in without you having to do anything.
2. Mr. Evil has access to the source of System Smart.
3. System Smart knows what to do to log in as you. (From the first point.)
4. Mr. Evil knows what Systems Smart knows. (From the second point.)
5. Mr. Evil knows what to do to log in as you. (From the third and fourth points.)

Conclusion: This scenario is not secure.

This is proof by contradiction if you start with the hypothesis that the scenario is secure.

Update: But if you want to just make it harder than plain-text then can use a symmetric key.

Answer 2

There are ways to obfuscate it, but ultimately none of those are much safer than plaintext if someone has access to the file - since you also need to decode it there to be able to log in on the provider's site.

Answer 3

The script has the capability to log you in to your provider unattended.

This means that anyone who controls the script will also have this capability, usable by running the script.

Nothing you can do will prevent this. The only solution is to either live with the potential compromise of your password, or to only place the script on a server you control.

Answer 4

If you want to go overboard on it you could set it up in such a way that your password is stored in a mysql database encrypted using aes_encrpyt and then you create another script on another server that makes calls to the server with your password requesting the password by providing the salt for use with the aes_decrypt function.