Tell me more ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.
up vote 3 down vote favorite

I am storing database passwords in app.config as plain text. I am also publishing the application.

How safe is that password stored in app.config? Can I use a disassembler and find it?

share|improve this question
1  
It's about as safe as writing your computer password on a post-it and putting it under your keyboard. I.e. 100% safe until someone flips your keyboard over. – pap May 15 '12 at 10:34
What can I do so that intruders can't flip the keyboard? – Marin May 15 '12 at 18:48
Make sure the intruders can't GET to the keyboard :) – pap May 16 '12 at 6:23
@pap - A post-it is the most secure password storage you can get. Even the best hacker won't be able to read it without entrng the room, (unless you point the web cam at it that is) – mattnz May 16 '12 at 7:12

1 Answer

up vote 10 down vote accepted

No, you cannot find the password with a disassembler. But you can read it plain as day if someone compromises your web server. At the very least, check these links:

http://www.4guysfromrolla.com/articles/021506-1.aspx

http://www.aspnettutorials.com/tutorials/advanced/encrypt-conn-str-asp4-cs.aspx

http://www.beansoftware.com/ASP.NET-Tutorials/Encrypting-Connection-String.aspx

Better yet, do not use SQL Server Security and instead use Integrated Security and only allow the account your web app (pool) runs under to access the DB.

share|improve this answer
TX for the insight – Marin May 14 '12 at 21:51
6  
Since the question was about app.config, not web.config, I suspect this is for a desktop application, and the "hacker" doesn't even need to compromise a web server. – JGWeissman May 14 '12 at 23:42
@JGWeissman nice catch. Though I have heard people refer to "app.config" as the overarching term, I suspect you're correct. – Jesse C. Slicer May 15 '12 at 1:16
It is a desktop application. – Marin May 15 '12 at 18:40
1  
@Marin then the plain-text app.config gives your users the keys to the castle. Definitely follow one of the bits of advice, please! – Jesse C. Slicer May 15 '12 at 19:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.