CODEWITHSUNDEEP
c#.netauthenticationpasswords
Roast
Roast

Reputation: 1755

Implementing a local password within an application

CONTEXT: I have a c# .net application made for a customer. The application has no network communication. In fact, the computer it runs on wont likely have any internet or network access.

In comes our customer with a very specific and non-negotiable request:

Request a administrative password before opening up certain screens and grant certain rights. This password must be within the application. The default password (i'll probably set it to 'password') must be changeable, so it can't be hard coded. And there ought to be some way to return to the default in case they forget the password.

It seems kind of superfluous to me just to stick a encrypted password in a file, in the application folder. Anybody who deletes the file would erase the password.

Is there some widely known strategy for this?

Again the password is local and not authenticated on any network.

Upvotes: 2

Views: 242

Answers (2)

sehe
sehe

Reputation: 393084

If it is on windows (is it?)

  1. Key Storage and Retrieval
  2. MSDN Security Briefs Article (part 1)
  3. MSDN Security Briefs Article (part 2)

Upvotes: 0

Xeo
Xeo

Reputation: 131799

Maybe hide it in the registry? If the registry key isn't there, then just remake it and set it to the default password. Hardcode the default password, maybe encrypted or something so someone who scans the .exe can't finde it. Also ask your client for what the default password should be, not simply make one.
The problem is, as long as you store something locally, everyone who really wants to know it, will find a way to get it. :/

Upvotes: 1

Related Questions