Hacker News Reader

We condemn anyone that stores passwords as plaintext. Time to treat access tokens as nothing less than a password.

How would you store access tokens on a device, using two-way encryption or do you have something else in mind?

Two way encryption, yep.

but then for any reasonable application to be able to use them they'll need to store the unencryption key anyway..

Obviously you wouldn't store the encryption key in plaintext...

It's encrypted keys all the way down.

That's easy! We could use two-way encryption to encrypt the encryption key.

What's wrong with 'correct horse battery staple'?