17

I created an c# application (not asp webpage) which connects to a sql 2005 server. In my sourcecode the password and userid for this sql-server is coded plain text in ConnectionString.

SqlConnection con = new SqlConnection();
con.ConnectionString = 
         "Data Source=server1;"+
         "Initial Catalog=mydatabase;"+
         "Integrated Security=no;"+
         "User ID=admin;Password=mypassword;";
con.Open();

Is there a easy way to encrypt password or whole connectionstring, that other peoples who disassemble my tool are not able to see the password?

thanks

5 Answers 5

8

You should store your connection string in a config file and encrypt that section. See https://web.archive.org/web/20211020203213/https://www.4guysfromrolla.com/articles/021506-1.aspx or http://msdn.microsoft.com/en-us/library/89211k9b%28VS.80%29.aspx.

0
5

There are two ways of doing it:

  1. You can use Configuration Secure Section to encrypt and decrypt connection strimng from your source code:
try
{
    // Open the configuration file and retrieve 
    // the connectionStrings section.
    Configuration config = ConfigurationManager.OpenExeConfiguration(exeConfigName);
    
    ConnectionStringsSection section = config.GetSection("connectionStrings") as ConnectionStringsSection;
    
    if (section.SectionInformation.IsProtected)
    {
        // Remove encryption.
        section.SectionInformation.UnprotectSection();
    }
    else
    {
        // Encrypt the section.
        section.SectionInformation.ProtectSection("DataProtectionConfigurationProvider");
    }
    // Save the current configuration.
    config.Save();
    
    Console.WriteLine("Protected={0}",
    section.SectionInformation.IsProtected);
}
catch (Exception ex)
{
    Console.WriteLine(ex.Message);
}
  1. You can Enterprise Library Data Access Application Block to perform the encryption using RSAProtectedConfigurationProvider or DPAPIProtectedConfigurationProvider.

For the full article go to --> http://msdn.microsoft.com/en-us/library/89211k9b(VS.80).aspx

2
  • 1
    thanks, but i dont know how to implement this. I just have a dll created out of my c# project - no exe and no app.config? also this dll has to be used on different computers and users!
    – Tobi
    Jan 29, 2010 at 7:55
  • One way is, you can create a XML file and store your settings in that. Then you can keep that XML in some specific location in each of ur deploying machines, and then you can read it. One of the best technique is to use a custom configuartion manager, i.e. a different class library which manages your configuration items, and ur main DLL would reference that or you could use the Congfiguration Block present in Enterprise Library.
    – Bhaskar
    Jan 29, 2010 at 8:32
3

No, you can only make it difficult

It is better to let the application use a special database login which only got access to the tables/procedures necessary.

0

You can encrypt sections in the app.config in the same way as web.config. MS calls it Protected Configuration. Since both the enrypted data and the key resides on the same machine it only makes it harder but in theory not impossible to get to the data.

-2

you can also store the UserName and Password in the Registry instead of storing in the config file. Read the Username and Password from registry when trying to connect to the database. Remember you have to Encrypt the Username and password while storing in the Registry and Decrypt the Username and Password while retrieving from the Registry.

5
  • 1
    Storing plain text information in the registry is not much different than a config file. This more of a sense of security only when you take into account the threat you are preventing. If they already have access to that file, it's very likely they have access to that registry key. They know what they're looking for. Aug 5, 2011 at 20:46
  • but the OP explicitly stated 'Remember you have to Encrypt the Username and password' Sep 22, 2011 at 7:51
  • Application configuration files (app.config and web.config) have been specially created to contain this kind of information. So it is much more efficent and simpler to manage user/password, connection strings and all other application settings with those files rather then using the Windows Registry. Expecially on a server environment with ASP.NET applications. Nov 4, 2014 at 10:16
  • @CheshireCat more efficient? Depend. Windows registry is made to hold configuration and the like that in the past was the INI files, *unix systems use files for that and you can have you option just by seeing the lot of config files on a *unix system. But by platform specification registry is a better place to hold configuration for a desktop application. Aug 22, 2016 at 3:11
  • You should never store sensitive data in a configuration file, ever. A registry can be secured much better than a file. It's much hard to copy the registry than a file. Storing in memory far exceeds either one. Jul 8, 2020 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.