Would a &quot;master password&quot; (a la Firefox&#x2F;Thunderbird) be the way to go (as input to an encryption routine)?<p>It seems like any credentials that can be automatically used after a program loads without the user authenticating are at risk for malware harvesting.