Any one has ideas who implemented securing password on snow sql config file apart from restricting access to file?
As an alternative to storing a password, for interactive use of Snowsql consider browser based SSO authentication Using a Web Browser for Federated Authentication/SSO
For scenarios where that is not feasible, consider storing the password in an environment variable.
If you are going to put the password in your config file then it is going to be in plain text and you can only restrict it by restricting access to the file.
Related
I'm coding an AS3 AIR app that has an SQLite database. I'd like to encrypt the database so that the user can feel comfortable saving sensitive information in it ie if a hacker gains access to the user's database file remotely, they won't be able to load it into their own copy of the app to read the data. However, I don't want to make the user enter a password each time they use the app.
Is this possible, or is password authentication the only way please?
Encryption of database and access on platform are two different issues.
About access:
Your app can have a system to remeber, after you have installed, so you don't put anytime your password, because it know you.
About encryption:
You can encrypt your data with a secure algorithm, so you don't show in your table the real content but encrypted content. So when you show in your app the content, you must implement a decodifier of your data.
I was wondering if there is an already deployed feature in Jfrog Artifactory that stores the user's password history.
I would like to have the ability to reject a password which is the same with some that has been used in the resent past.
One solution that I thought is a custom implementation which will query the password history of a user from the MySql database and search in the reults for the given password.
I am using the 6.3.3 version of Jfrog Artifactory.
That feature doesn't exist as far as I know in Artifactory today, if you're configuring the users in Artifactory itself. If you're using an external user store (like LDAP), you could set those rules there.
JFrog Access provides some password policy rules (see here). But Artifactory does not persist passwords (or old passwords) due to security considerations.
You might argue such a feature can be implemented with password hashes which is correct, but no such thing is currently implemented - you can always submit a feature request
I have a problem. I have saved more than one database's password in application setting file and read password in this file when application started.
Properties.Settings.Default.Databases.Password
But, this is not secure. I want to make it secure. I use winforms.
I am attempting to automate a process. I have setup a webpage with very basic security:
I want to automate the ability to log in. The same username/password combination is used each time, but there are hundreds of IP addresses in use, so it would be tedious to use a password safe programme.
I am wondering if I can use something in the form of url.com/?username=user&password=pass to push the password through the security, without having to manually enter the details each time?
This worked for me http://username:password#url.com.
Note: I am using this on a secure network to save time, I do not recommend this is used outside of a controlled environment.
i'm developing a .net winforms desktop application intended to be run at several bank's branches as a backup application whenever the main one (a web application) is unavailable due to connection issues with the bank's central node. The branchs themselves don't count with any enterprise services besides a SQL-Server database. For that reason, the application should be able to connect directly to the SQL-Server. My problem arises when I have to provide the application with a password to connect to the database:
1) Storing the password in clear text in a app.config file or similar is not an option (the customer requires the password to be encrypted)
2) Storing the password encrypted in a configuration file leads to the need of having an encryption key locally available. The encryption key could be just hardcoded in the application's code, but it would be easily readable by using a .net-decompiler or similar.
3) Using a custom algorithm to encrypt/decrypt wouldn't work either due to the same reasons as 2).
4) Integrated security is not supported by the bank
Additionally, the customers requires that they should be able to change the password in one location (within a branch) without the need to go from one computer to another updating config files (that rules out the possibility of using the machine's key to encrypt the password in individual machine's config files like asp.net does)
Would you provide any other approach or suggestion to deal with this problem?
I would appreciate any help.
Thanks in advance,
Bernabé
I don't think that encyrpting the password by any means is going to solve your problem. If the user has to send the password to server, and the password is located on the box, then by definition the user running the application must have access to the password and be able to decrypt it. Otherwise, you wouldn't be able to authenticate them. This means that there will always be a way for the user to get at the password, regardless of where you store it.
I can think of 2 ways that could possibly work, but I'm afraid they're not exactly what you're looking for.
Remove the requirement of having the
user send the password to the server
by using some sort of local proxy
(for example using a WCF windows
service) to take your winform
requests and then send them on your
behalf to the DB server. If you
install the service using an account
different from the user's account,
then you can secure the password by
any of the means mentioned in the other
answers. They key here is to make
sure the application user does not
have access to the resources that
the service account needs to decrypt
the password.
Don't store the password in the web config. Assign each user a different user account and password at the database level and have them type it in when they log in.
You could use the protected configuration built into .Net. See Encrypting Configuration Information Using Protected Configuration in the MSDN docs. One of it's raison d'etres was to encrypt data such as connection strings in config files.
You could
To use DPAPI to store a encryption/decryption key securely: How To: Use DPAPI to Encrypt and Decrypt Data
To install a SQL Server Compact Edition (or another small database) into your workstations and to synchronize data when your web application comes online again.
To ask for help inside that institution, as other people could have solved that problem and could to help you.
Definitely agree with the above regarding DPAPI. Microsoft's Enterprise Library makes this an absolute breeze too, so I would consider looking there first.