Regarding the Salesforce security review process, can anyone confirm (or deny) that storing a connection URL, username and password for a webservice utilized by an appexchange app can be done in plain text so long as it is within a protected custom setting record, and an appropriate interface (or initialisation script) is provided for accessing these fields?
ie. I have a protected custom setting record, and a "safe" way of injecting the values. Can I therefore store the password simply as a text field, or do I also need to go through the process of encrypting/decrypting the text in order to satisfy a security review?
This excerpt from the checklist suggests so to me - as it refers to encryption as "another option", but I would love to get some real-life feedback from other developers' experience.
Ensure that sensitive information is not available to all users in a customer org. This can be achieved by using Custom Settings in "Protected" mode, and creating a Visualforce page for authorized users to update information. The previously stored data should not be displayed back to the user on this page. Another option is to implement Apex Crypto and store the encryption key in a protected custom setting. For more information see the Secure Cloud Development entry for Storing Secrets.