CODEWITHSUNDEEP
sql-serversecuritysql-server-cedatabase-connection
ProfK
ProfK

Reputation: 51114

How can I protect the password for an encrypted SQL Server Compact database?

I have found a few resources that tell me causing a SQL Compact DB to be encrypted is as simple as specifying a password in the connection string. But, I am not comfortable leaving that password in my web.config file. I know I can supply a connection string for a DbContext dynamically, at runtime, but even there, I'm still including a plain text password in the connection string. How can I minimise points in my code where this password is vulnerable?

Upvotes: 1

Views: 511

Answers (2)

usr
usr

Reputation: 171246

Clearly, if the hosting company has access to the server, you cannot win. You cannot prevent them from learning the password if they really want to.

So all you can do is obfuscate the password. I think a good tradeoff is to hard-code the password in the sourcecode like this:

var plainPassword = Enconding.UTF8.GetString(Convert.FromBase64("encoded-pw-here"))

That should protect is from simple string searches and such. I don't think you can or should do much more.

Upvotes: 1

YvesR
YvesR

Reputation: 6232

Why do you fear having the password on a server? Most systems, e.g. Rails in a database.yml file, store their connection somewhere.

But what you can do to protect it is to create a encryption.dat file which holds your connection. In your web.config file you just place the "name" of the connection, and then you need a class that can encypt/decrypt your connection string and put it in place on runtime.

A sample project you can find here: http://www.codeproject.com/Articles/14150/Encrypt-and-Decrypt-Data-with-C

But this won't give you 100% security and I doubt it is worth the effort. Better make sure your windows saver is secured correctly so no one can access it without permission.

Upvotes: 0

Related Questions