Groups | Blog | Home
all groups > dotnet faqs > march 2004 >

dotnet faqs : web.config best pratices for passwords


Jay Douglas
3/23/2004 12:28:11 PM
Hello all.
I have a few different applications that store passwords for various
items in the web.config file in plain text. (i.e. SMTP Credentials, DB
connection strings) .. I know this is a pretty serious security risk,
however I'm having a hard time find a better way to allow easy modification
of user name and passwords for application components. I was wondering what
type of input other developers may have or possibly a Url containing some
good information.

Thanks in advance.

--
Jay Douglas
Fort Collins, CO



Harry Simpson
3/23/2004 1:47:33 PM
Best practice is to salt (add know alphanumeric string) and encrypt and
store somewhere such as the global.asax.vb file. Ideally using the registry
is even better.

I personally use 256bit AES encryption with part (encrypted) in web.config
and the other part in the global.asax.vb. Then when the application begins
I decrypt and build the string on demand. I leave the server IP unencrypted
so i can easily point to another server for the DB if needed.

Harry

"Jay Douglas" <REMOVEIFNOTSPAMjaysnewsgroupaddress@squarei.com> wrote in
message news:uUa5QzQEEHA.1228@TK2MSFTNGP11.phx.gbl...
[quoted text, click to view]

John Timney (Microsoft MVP)
3/23/2004 8:52:05 PM
if the servers yours, then you can use the utilities that come ith asp.net
to provide password encryption.
http://support.microsoft.com/default.aspx?scid=kb;en-us;329290

If its not, then you will need to roll your own encryption approach using
something like an MD5hash

--
Regards

John Timney
Microsoft Regional Director
Microsoft MVP


"Jay Douglas" <REMOVEIFNOTSPAMjaysnewsgroupaddress@squarei.com> wrote in
message news:uUa5QzQEEHA.1228@TK2MSFTNGP11.phx.gbl...
[quoted text, click to view]

Jay Douglas
3/23/2004 8:56:40 PM
John,
Prefect, thx a ton.

--
Jay Douglas
Fort Collins, CO



[quoted text, click to view]

AddThis Social Bookmark Button