I am trying to implement the capability for my program (C++) to remember a user/password combination, so the user does not need to type it in again.
Is there a secure way for my program to store this? Preferably cross platform as well.
I am trying to implement the capability for my program (C++) to remember a user/password combination, so the user does not need to type it in again.
Is there a secure way for my program to store this? Preferably cross platform as well.
Is there a secure way for my program to store this? Preferably cross platform as well.
Secure against what kind of attack?
Reframe the problem. The user experience goal - allow the user to authenticate without credentials - is the real goal. This kind of security goal is not well-suited to endpoints. There are safer alternative solutions than saving the username and password, one of which I will suggest now. Bear in mind that this only works if you control the server or can deploy an intermediary like a proxy.
Create a time-limited token on the server. Associate it with the user. When the user connects the program supplies the token if present and is authenticated. Otherwise the user is prompted for credentials.
With an intermediary you would store the credentials on the intermediary keyed by the token in an encrypted form and use a separate encryption service (something like Amazon KMS perhaps) to decrypt them.
Again, if you only have client side control then the best option you have is similar to the above using an encryption service from the client, but then you are subject to endpoint attack at @SteffenUlrich has already identified in his response. There are APIs that transparently wrap platform specific key management solutions like gnome-keyring, OS X's KeyChain, and Windows Credential Vault under a common API. For example this Python keyring module does that:
https://pypi.python.org/pypi/keyring
At that point the credentials are as secure as anything else the OS is managing.