在 Windows 8 中保存敏感数据的最佳实践

UPDATE: Please be aware that while modern/metro apps are restricted from poking at each other's stuff, desktop applications will have unrestricted access to all data stored through these APIs. See http://www.hanselman.com/blog/SavingAndRetrievingBrowserAndOtherPasswords.aspx which includes code demonstrating this.

Win8 有一个名为 的新 APIPasswordVault 旨在为您解决所有这些难题.非常易于使用、安全，并且可以由用户配置为在他们的机器之间漫游，因此他们只需输入一次凭据.我已成功将其用于 OAuth 令牌

Win8 has a new API called PasswordVault that's designed for taking care of all these hard problems for you. Really easy to use, secure, and can be configured by users to roam between their machines so they only have to enter credentials once. I've successfully used this for OAuth tokens

检索凭据(注意 WinRT 引发的愚蠢异常......他们真的应该只返回 null):

Retrieving credentials (note the stupid exception that WinRT raises... they really should just return null):

const string VAULT_RESOURCE = "[My App] Credentials";
string UserName { get; set; };
string Password { get; set; };
var vault = new PasswordVault();

try
{
   var creds = vault.FindAllByResource(VAULT_RESOURCE).FirstOrDefault();
   if (creds != null)
   {
      UserName = creds.UserName;
      Password = vault.Retrieve(VAULT_RESOURCE, UserName).Password;
   }
}
catch(COMException) 
{
   // this exception likely means that no credentials have been stored
}

存储凭据:

vault.Add(new PasswordCredential(VAULT_RESOURCE, UserName, Password));

删除凭据(当用户单击应用中的注销按钮时):

Removing credentials (when the user clicks the logout button in your app):

vault.Remove(_vault.Retrieve(VAULT_RESOURCE, UserName));

这篇关于在 Windows 8 中保存敏感数据的最佳实践的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持编程学习网！