I think there are two issues to keep in mind:
- unauthorized access to your server
- learning the password to access other services (because people are lazy and reuse passwords)
How to prevent abuse of the decrypted password elsewhere?
The second attack vector can be prevented by not storing the real password in any decryptable form at all. But a token generated by the server or a password hash that the server will accept instead of the password.
How to prevent unauthorized access to your game?
We are assuming here, that the attacker has access to the users computer in order to retrieve the password file. Based on this assumption it is likely that the attacker has write access, too. But if he has write access, he can modify program files and do all sorts of nasty things. So we have lost.
That being said, there is a number of things you can do to make it more difficult for the attacker. Based on my experience with Stendhal most attacks are done by family members, who don't have a deep knowledge. So easy tricks make a difference:
- hiding the password file somewhere outside the game folder
- "bind" it to a specific computer by using the MAC address of the first network card or the serial number of the hard disk to encrypt the authentication information with.
- "bind" it to the username by using it to encrypt the authentication information with.
Note: None of this things give you real security. But they do reduce the number of incidents and thus reduce support costs.
By the way: WoW, which is quite famous, does not allow to save the password.