I am developing a desktop application. Multiple users shall be using it to insert, delete and select data from database. As users shall be using it so they would not have to login to database.
I know how to use JDBC (for Java Applications), I need suggestions that I don't want to hard code the credentials of database like host address, username, password ... etc. So if change of credential is needed I can change it without changing the code. Also, I cannot just put database credentials in a text file and read every time when the application need to interact with database.
You can create a ApplicationConstants file which will store the host address, username and password.
If you need to change it you'll have to change it only in one location.
But this will require you to compile the code everytime you make changes.
The alternative is to encrypt the values and store the encrypted values in a text file.
You can use the javax.crypto for encryption/decryption. You can find an example on the following link :
Simple java AES encrypt/decrypt example
Related
I'm coding an AS3 AIR app that has an SQLite database. I'd like to encrypt the database so that the user can feel comfortable saving sensitive information in it ie if a hacker gains access to the user's database file remotely, they won't be able to load it into their own copy of the app to read the data. However, I don't want to make the user enter a password each time they use the app.
Is this possible, or is password authentication the only way please?
Encryption of database and access on platform are two different issues.
About access:
Your app can have a system to remeber, after you have installed, so you don't put anytime your password, because it know you.
About encryption:
You can encrypt your data with a secure algorithm, so you don't show in your table the real content but encrypted content. So when you show in your app the content, you must implement a decodifier of your data.
In a self-hosted C1-CMS (formerly Composite C1), how can I reset or recover the password? Can the password be viewed or reset somewhere on the server?
(Composite C1 4.3, Build 4.3.5555.25838)
If you are using the default XML data store, the users and encrypted passwords are stored in: /App_Data/Composite/DataStores/Composite.Data.Types.IUser.xml
If you have another user with a password you know, you can replace the encrypted password string on the account you are trying to access, with the encrypted password from the account you know. Then login and change the password.
I received this answer from the official Orckestra support team (very helpful, although I am not a paying customer, thumbs up!):
You cannot recover the password, but if you have access to the files (or SQL Database, if you migrated data to SQL) you can reset the password:
This should work for sites running on XML data store (default):
Edit the file ~/App_Data/Composite/DataStores/Composite.Data.Types.IUser.xml
Locate the xml element for the user you want to reset the password for
Change the following two attributes to the shown values:
EncryptedPassword="hsfIeqkVA5yoMIwzYIx4fWny5GjwNwiM3wA5K+9qCug="
PasswordHashSalt="/zgEhlwBe6Vl0HHqMFPxafrtwqlRIGVS"
Save the file.
If your site is on SQL, locate the table Composite_Data_Types_IUser_Published and put the above shown values into the corresponding columns (EncryptedPassword and PasswordHashSalt).
You should now be able to log in using the password "123456" for the user you changed above. Once in the CMS Console, you can set a new password using the top Tools menu (top right user menu n V5 and later).
I recently had a scenario where neither of the suggested methods would work for me. I was able to remedy this by creating a c1 instance locally, creating a user with the same username and the desired password, and then overwriting the password salt and hash from the local site to the one you're locked out of.
I would like to know how i could create a log in program with some method of data storage that stores the login information of registered users and then accesses it when users type in their log in details for verification?
I do know how to create a basic login program with labels,buttons and edit boxes but do not know how to store information about the users registered and then access this again.
The fact that you have included the 'database' tag in your question implies that you already know what the solution is - a database. If your program already uses a database, add a table for users which includes their real name, their user name and their encoded password. Your login screen will have to query this table to check whether the user is valid. Make sure that you use parameters to the query; this way you avoid the possibility of sql injection (query 'little bobby tables').
Using PHP, does anyone know how to make it so that when someone registers on a website (and therefore enters data into a database), a folder with a default php file is created on the web root/server???
This is not a good design. Rather, you should have your PHP files look at the session to find the logged in user's id, and query the necessary data about that user id. You don't need a file for each user. You can make your table auto-increment a user id.
i'm developing a .net winforms desktop application intended to be run at several bank's branches as a backup application whenever the main one (a web application) is unavailable due to connection issues with the bank's central node. The branchs themselves don't count with any enterprise services besides a SQL-Server database. For that reason, the application should be able to connect directly to the SQL-Server. My problem arises when I have to provide the application with a password to connect to the database:
1) Storing the password in clear text in a app.config file or similar is not an option (the customer requires the password to be encrypted)
2) Storing the password encrypted in a configuration file leads to the need of having an encryption key locally available. The encryption key could be just hardcoded in the application's code, but it would be easily readable by using a .net-decompiler or similar.
3) Using a custom algorithm to encrypt/decrypt wouldn't work either due to the same reasons as 2).
4) Integrated security is not supported by the bank
Additionally, the customers requires that they should be able to change the password in one location (within a branch) without the need to go from one computer to another updating config files (that rules out the possibility of using the machine's key to encrypt the password in individual machine's config files like asp.net does)
Would you provide any other approach or suggestion to deal with this problem?
I would appreciate any help.
Thanks in advance,
Bernabé
I don't think that encyrpting the password by any means is going to solve your problem. If the user has to send the password to server, and the password is located on the box, then by definition the user running the application must have access to the password and be able to decrypt it. Otherwise, you wouldn't be able to authenticate them. This means that there will always be a way for the user to get at the password, regardless of where you store it.
I can think of 2 ways that could possibly work, but I'm afraid they're not exactly what you're looking for.
Remove the requirement of having the
user send the password to the server
by using some sort of local proxy
(for example using a WCF windows
service) to take your winform
requests and then send them on your
behalf to the DB server. If you
install the service using an account
different from the user's account,
then you can secure the password by
any of the means mentioned in the other
answers. They key here is to make
sure the application user does not
have access to the resources that
the service account needs to decrypt
the password.
Don't store the password in the web config. Assign each user a different user account and password at the database level and have them type it in when they log in.
You could use the protected configuration built into .Net. See Encrypting Configuration Information Using Protected Configuration in the MSDN docs. One of it's raison d'etres was to encrypt data such as connection strings in config files.
You could
To use DPAPI to store a encryption/decryption key securely: How To: Use DPAPI to Encrypt and Decrypt Data
To install a SQL Server Compact Edition (or another small database) into your workstations and to synchronize data when your web application comes online again.
To ask for help inside that institution, as other people could have solved that problem and could to help you.
Definitely agree with the above regarding DPAPI. Microsoft's Enterprise Library makes this an absolute breeze too, so I would consider looking there first.