Timeline for How to handle database connection password?
Current License: CC BY-SA 4.0
21 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 20, 2019 at 7:49 | history | edited | M.R. | CC BY-SA 4.0 |
added 3 characters in body
|
| Apr 19, 2019 at 21:04 | history | edited | doubleYou | CC BY-SA 4.0 |
deleted 10 characters in body
|
| Apr 19, 2019 at 16:00 | vote | accept | M.R. | ||
| Apr 19, 2019 at 15:55 | comment | added | M.R. | Robert, that answers my question, thank you all for trying to help. | |
| Apr 19, 2019 at 15:55 | answer | added | JimmyJames | timeline score: 6 | |
| Apr 19, 2019 at 15:20 | comment | added | Robert Harvey | security.stackexchange.com/questions/35235 | |
| Apr 19, 2019 at 15:18 | comment | added | Robert Harvey | Your question is probably too broad to be answerable here, for several reasons. We use Crypto in the .NET Framework to encrypt ours, and store the password so encrypted in an external file. It's not perfectly secure, of course; a determined person could reverse-engineer the code and get at the password, but it deters all but the most committed folks, and our data is not that critical or attractive to an attacker. For "better" security, the database needs to be taken out of the client, and accessed by an intermediary on the server like a Service Layer. | |
| Apr 19, 2019 at 15:17 | comment | added | Arseni Mourzenko | Also note that whenever the response, you would at some point need to create an intermediary between the users and your database, simply because there are things databases don't handle well. 2FA. DDOS. Brute force attacks. MITM. Impersonation. Replay attacks... | |
| Apr 19, 2019 at 15:14 | comment | added | Arseni Mourzenko | So you want to “safely” store on a client machine the password used to connect to the database, right? In this case, you should define “safely,” as well as to explain what use devices we are talking about. A desktop PC with a group policy of the company applied to it is one thing. A mobile device bought by the user, where the user can install any games and apps he wants is a very different story. | |
| Apr 19, 2019 at 14:22 | comment | added | M.R. | From the client machine. | |
| Apr 19, 2019 at 14:19 | comment | added | JimmyJames | Is the database connection happening from a client machine or on a server? | |
| Apr 19, 2019 at 14:18 | comment | added | JimmyJames | Relevant: github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/… | |
| Apr 19, 2019 at 14:17 | comment | added | M.R. | To clarify: The user's passwords would be(note the would be) stored safely(salted hash) in the Users table, they are stored so I have something to compare them against. I'm asking about the connection to the server. My application would be an interface to the database. | |
| Apr 19, 2019 at 14:02 | comment | added | Arseni Mourzenko | And why are you storing users' passwords in the first place? Those are users' passwords. You shouldn't store them, and you shouldn't know them. | |
| Apr 19, 2019 at 14:00 | review | Close votes | |||
| Apr 28, 2019 at 3:05 | |||||
| S Apr 19, 2019 at 13:48 | history | suggested | TGnat | CC BY-SA 4.0 |
fixed spelling in title
|
| Apr 19, 2019 at 13:47 | review | Suggested edits | |||
| S Apr 19, 2019 at 13:48 | |||||
| Apr 19, 2019 at 13:47 | history | edited | M.R. | CC BY-SA 4.0 |
edited title
|
| Apr 19, 2019 at 13:40 | review | First posts | |||
| Apr 19, 2019 at 21:05 | |||||
| Apr 19, 2019 at 13:38 | comment | added | Dan Wilson | Typically you would store the connection string in a settings file or use integrated authentication (service account). | |
| Apr 19, 2019 at 13:36 | history | asked | M.R. | CC BY-SA 4.0 |