You are incorrect in your assumption that all information is share in the currentProfileData between applications. The information is specific to the application that is pulling the data from storage.

[snip]

I would be a huge security flaw if every application could access information from all the other applications, but this is not the case.

This data is private for a profile, but available to all widgets and can be overwritten by another widget if the same access key is used.

Actually, you're incorrect. Read Chapter 11. Persistent Storage

Explain to me why that would be a security flaw? What if I did not want to store something confidential? What is the security flaw in that?

I need to store user login credentials, with the intention that they will be shared across several of our upcoming applications.

I am planning on using currentProfileData to allow this.

From my understanding, anything stored in currentProfileData can be read by any widgets, which could potentially create a security issue of other widgets viewing the credentials.

What are my options for sharing credentials, but limiting it to only our applications? I was planning on a JS TEA Encryption Algorithm (http://www.movable-type.co.uk/scripts/tea-block.html) to encrypt the credentials. Any additional options?

Also, if I call:

CODE

currentProfileData.set('credentials', credentials);

and some other app does the same, then my credentials could be overwritten. Is there a suggested practice, as far as creating a namespace for our profile data specific to our apps?

I'm assuming I would just create one object/map that I store using currentProfileData, and use a reverse domain notation, or something like that. For example:

CODE

currentProfileData.set('companyNameSpace', "{ "credentials" : ... }");

Thanks

Currently, there's no model for this. In lieu of it, I think your idea to store an object with a reverse domain notation key would make the chances of it being overwritten unlikely.