I have a problem. I have saved more than one database's password in application setting file and read password in this file when application started.
Properties.Settings.Default.Databases.Password
But, this is not secure. I want to make it secure. I use winforms.
Related
Any one has ideas who implemented securing password on snow sql config file apart from restricting access to file?
As an alternative to storing a password, for interactive use of Snowsql consider browser based SSO authentication Using a Web Browser for Federated Authentication/SSO
For scenarios where that is not feasible, consider storing the password in an environment variable.
If you are going to put the password in your config file then it is going to be in plain text and you can only restrict it by restricting access to the file.
I'm coding an AS3 AIR app that has an SQLite database. I'd like to encrypt the database so that the user can feel comfortable saving sensitive information in it ie if a hacker gains access to the user's database file remotely, they won't be able to load it into their own copy of the app to read the data. However, I don't want to make the user enter a password each time they use the app.
Is this possible, or is password authentication the only way please?
Encryption of database and access on platform are two different issues.
About access:
Your app can have a system to remeber, after you have installed, so you don't put anytime your password, because it know you.
About encryption:
You can encrypt your data with a secure algorithm, so you don't show in your table the real content but encrypted content. So when you show in your app the content, you must implement a decodifier of your data.
I am developing a desktop application. Multiple users shall be using it to insert, delete and select data from database. As users shall be using it so they would not have to login to database.
I know how to use JDBC (for Java Applications), I need suggestions that I don't want to hard code the credentials of database like host address, username, password ... etc. So if change of credential is needed I can change it without changing the code. Also, I cannot just put database credentials in a text file and read every time when the application need to interact with database.
You can create a ApplicationConstants file which will store the host address, username and password.
If you need to change it you'll have to change it only in one location.
But this will require you to compile the code everytime you make changes.
The alternative is to encrypt the values and store the encrypted values in a text file.
You can use the javax.crypto for encryption/decryption. You can find an example on the following link :
Simple java AES encrypt/decrypt example
I have created a new Joomla database (different from the main database of the website but that will be having its I/O from the same website nonetheless) and added a user to it. It seems that the database password was generated automatically and now Fabrik is asking me to confirm the database password but I can't find it in the configuration.php file (presumably because it is new) or anywhere else. Is there anything I am missing? Where can I find that password or change it?
The only location in joomla where you will find the database password is in the configuration file assigned to the $password variable.
If it is not there then you will need to look in the backend (cpanel?) where you will be able to set a new one.
i'm developing a .net winforms desktop application intended to be run at several bank's branches as a backup application whenever the main one (a web application) is unavailable due to connection issues with the bank's central node. The branchs themselves don't count with any enterprise services besides a SQL-Server database. For that reason, the application should be able to connect directly to the SQL-Server. My problem arises when I have to provide the application with a password to connect to the database:
1) Storing the password in clear text in a app.config file or similar is not an option (the customer requires the password to be encrypted)
2) Storing the password encrypted in a configuration file leads to the need of having an encryption key locally available. The encryption key could be just hardcoded in the application's code, but it would be easily readable by using a .net-decompiler or similar.
3) Using a custom algorithm to encrypt/decrypt wouldn't work either due to the same reasons as 2).
4) Integrated security is not supported by the bank
Additionally, the customers requires that they should be able to change the password in one location (within a branch) without the need to go from one computer to another updating config files (that rules out the possibility of using the machine's key to encrypt the password in individual machine's config files like asp.net does)
Would you provide any other approach or suggestion to deal with this problem?
I would appreciate any help.
Thanks in advance,
Bernabé
I don't think that encyrpting the password by any means is going to solve your problem. If the user has to send the password to server, and the password is located on the box, then by definition the user running the application must have access to the password and be able to decrypt it. Otherwise, you wouldn't be able to authenticate them. This means that there will always be a way for the user to get at the password, regardless of where you store it.
I can think of 2 ways that could possibly work, but I'm afraid they're not exactly what you're looking for.
Remove the requirement of having the
user send the password to the server
by using some sort of local proxy
(for example using a WCF windows
service) to take your winform
requests and then send them on your
behalf to the DB server. If you
install the service using an account
different from the user's account,
then you can secure the password by
any of the means mentioned in the other
answers. They key here is to make
sure the application user does not
have access to the resources that
the service account needs to decrypt
the password.
Don't store the password in the web config. Assign each user a different user account and password at the database level and have them type it in when they log in.
You could use the protected configuration built into .Net. See Encrypting Configuration Information Using Protected Configuration in the MSDN docs. One of it's raison d'etres was to encrypt data such as connection strings in config files.
You could
To use DPAPI to store a encryption/decryption key securely: How To: Use DPAPI to Encrypt and Decrypt Data
To install a SQL Server Compact Edition (or another small database) into your workstations and to synchronize data when your web application comes online again.
To ask for help inside that institution, as other people could have solved that problem and could to help you.
Definitely agree with the above regarding DPAPI. Microsoft's Enterprise Library makes this an absolute breeze too, so I would consider looking there first.