通过Internet连接MySQL和.net应用程序有危险吗？

Question

For a small project I need to store some data in MySQL. The users are located world wide and run a .net ClickOnce application. The data accessed are not really confidential and even if someone would get access this would not harm from the privacy perspective.

Technically it is possible to have the MySQL database located on a server somewhere and have everybody connected via Connector/Net over the internet. But is this advisable?

1. Is the protocol stable / robust enough to handle even slow internet connections?
2. Would this be a severe security risk. Encryption of the data is not a topic, but password encryption is. Would opening a MySql database (port) to the Internet be a hazard?

Alternatively I could "wrap" the DB access via web services, or somehow else. But of course this is some overhead I'd like to avoid. So is connecting MySQL via Internet a valid option?

Remarks:

• No duplicate of MySQL connection with VB.NET via internet!
• SO Connecting to the database via the internet is less specific, and has no answer as of today.

Answer 1

I'd recommend implementing a REST web services layer for your remote .NET applications to talk to. Then you could have the server that handles the web service requests have local access to the database and you wouldn't worry about whether the MySQL protocol was up to the job.

My experience is that the MySQL protocol might work over a WAN, but it's really intended to be used on a local network, so the latency of the WAN would make the transaction intolerably slow.

Also the MySQL Server would have to expose its port (3306 by default) and that's not really hardened so unless you connect via VPN or stunnel or something it wouldn't be secure.

The MySQL client/server protocol does not transmit passwords in plain text, it hashes the password on the client before sending. But I understand MySQL Connector/NET doesn't use the MySQL client, so I don't know for certain if it does the same thing with password hashing on the client end.

Answer 2

1) This protocol is stable, was using it for long time.

2) You shouldn't share your DB outside youre local network, it's a high security risk. You should make some layer on your DB server throgh which you will access data from the DB. Also you can make WCF server between client-side and db .