I’m working on an add-in that will integrate git into the VBA IDE. I’m using the LibGit2Sharp library under the hood, which supports User name and password credentials, but not SSH Keys. I would use GitHub’s SSH Keys if the library supported them, but it doesn’t.

So, I can easily enough ask the user for their credentials prior to trying to interact with the remote repository, but I can feel the “bug” reports coming in already.

Why do I have to provide my password every time I try to push to my repo?

So…

Question 1:

Is it safe and acceptable to keep the password in memory after the user has entered it the first time? If there are caveats to that being safe or unsafe, what are they?

Question 2:

I can also see users not wanting to keep entering their password even on the first time they push during a session. Would it be safe enough to encrypt (not hash) the user name and password and store them along with the add-in’s other configuration settings?

I mean, Visual Studio doesn’t ask me for my GitHub credentials each time I start up the IDE, so it must be possible to do this relatively safely. But how?

I have read through many related questions, but feel no closer to knowing how to go about safely using my users’ credentials in my add-in. Most of the existing questions relate to websites and databases, where the right answer is “don’t store the password in a recoverable way, salt and hash it and store the hash only”, but in this instance, it’s not a password to my service. I need to secure it the best I can, but in a recoverable way. Otherwise, there’s no way my program can “log into” their repository on their behalf.