当应用程序将在多台机器上使用时，在 C# 代码中隐藏密钥（密码）的最佳方法？

Question

To access a API, I have to have a secret key. How would you approach storing that secret key, if this is going to be used on multiple machines?

I read this answer , and if I understand it correctly, besides some obfuscation, there's no point doing anything more?

Answer 1

It's not easy because IL code is readable. And the IL code easily gain from a binary like DLL or EXE using IL Disassembler: ildasm.exe.

The solution that @miniHessel said, downloading the code from a server using SSL is also not a safety solution, because a client on his/her own machine can track the SSL communication doing a "MITM attack" with a proxy like Fiddler or any other app. We have a lot.

We can only make things more difficult: One solution is to encrypt the secret and keep the encrypted secret in the code. (before you use it you can decrypt it) Better if you cut the encrypted secret to multiple parts and keep it different place in the code. And merge them before you decrypt it. Give the variables and functions innocent name, so noone can figure out what the content is.

A good encryption/decryption solution is here: Encrypting & Decrypting a String in C#