Second safest is to store a one-way (non-reversible, cryptographic)
hash (digest). SHA-1 or otherwise, and with associated data (the
user and some other known but varying data) incorporated into the
input to reduce the exposure to rainbow table attacks.
That's a good answer for a server app, that needs to authenticate
users. But I was assuming this code was part of a client app, doing
something like saving the user's login password to avoid asking for it
every time. In which case the Keychain is the right solution.
