I want to create a plugin addon that allows my sites users to share private login information in a secure manner. So they'll enter these private details in a form on the frontend and I want to be able to decrypt it on the backend. What's the best way to go about this, because as far as I'm aware password encrypting is a one-way process, or will I be able to use encrypt() or password ()?

  • How are you planning to store the keys to decrypt the data? You could either just use symmetric encryption, where there's a single secret key used to both encrypt and decrypt the data, but that one secret would need to be known to WordPress and so anyone who can hack the code and database can get it. Alternatively you can use private key encryption, so data is encrypted to your or your site's public key, then you'd need to use the private key to decrypt it; you e.g. store your secret key in a GPG keyring and have to give WordPress an extra password to unlock it – Rup Jul 26 '20 at 11:33
  • or you could copy the public-key-encrypted data out of the backend and e.g. use GPG to decrypt that away from the site. – Rup Jul 26 '20 at 11:34
  • I don't think you can use encrypt and password, no. Here's a question on StackOverflow that recommends using openssl or libsodium instead. – Rup Jul 26 '20 at 11:34
  • But as general security advice: don't store other people's passwords, and they shouldn't be giving them to you. – Rup Jul 26 '20 at 11:40
  • Thanks Rup, I will look into your suggestions. As for your general advice, 1) it's completely normal for websites to store user passwords, and 2) why shouldn't they be giving them to me? If I do anything unethical with them, I will be breaking the law. As long as I am not a criminal and my clients have my trust, there's no issue. It's normal for people to provide login information for technical support. They are always recommended to create a new user for me, and not handover password information that they may use elsewhere. – dylzee Jul 27 '20 at 2:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.