How to not hardcode passwords?

Question

In my last question "Portable database for storing secrets" the best answer until now tell to use sqlite-crypt.

Reading sqlite-crypt docs, the new param for open the database is the pass-phrase. Of course, I don't want hardcode the password, so I was thinking what the best, simple and fast method to store that password?

Answer 1

Some options.

1. Ask the user for a passkey (aka they memorize one password to get to all their password) (good idea)

2. Create a key on the first startup of the app, which is then hashed in your own unique way (bad idea)

3. Use a mixture of the above, aka give users the options of one, or two (remember my password checkbox)

Answer 2

You pretty well have to store it in a user.

Otherwise you're just substituting some other security mechanism for the one you're asking about...

---

David's point in the comment on Infamy's answer is well taken. One should allow some flexibility, in case the user is handling protection at a lower layer... So, go vote for Infamy.