7

I am storing database passwords in app.config as plain text. I am also publishing the application.

How safe is that password stored in app.config? Can I use a disassembler and find it?

4
  • 2
    It's about as safe as writing your computer password on a post-it and putting it under your keyboard. I.e. 100% safe until someone flips your keyboard over.
    – pap
    Commented May 15, 2012 at 10:34
  • What can I do so that intruders can't flip the keyboard?
    – Marin
    Commented May 15, 2012 at 18:48
  • Make sure the intruders can't GET to the keyboard :)
    – pap
    Commented May 16, 2012 at 6:23
  • 2
    @pap - A post-it is the most secure password storage you can get. Even the best hacker won't be able to read it without entrng the room, (unless you point the web cam at it that is)
    – mattnz
    Commented May 16, 2012 at 7:12

1 Answer 1

11

No, you cannot find the password with a disassembler. But you can read it plain as day if someone compromises your web server. At the very least, check these links:

Better yet, do not use SQL Server Security and instead use Integrated Security and only allow the account your web app (pool) runs under to access the DB.

5
  • TX for the insight
    – Marin
    Commented May 14, 2012 at 21:51
  • 6
    Since the question was about app.config, not web.config, I suspect this is for a desktop application, and the "hacker" doesn't even need to compromise a web server.
    – JGWeissman
    Commented May 14, 2012 at 23:42
  • @JGWeissman nice catch. Though I have heard people refer to "app.config" as the overarching term, I suspect you're correct. Commented May 15, 2012 at 1:16
  • It is a desktop application.
    – Marin
    Commented May 15, 2012 at 18:40
  • 1
    @Marin then the plain-text app.config gives your users the keys to the castle. Definitely follow one of the bits of advice, please! Commented May 15, 2012 at 19:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.