在哪里存储应用程序运行所需的敏感信息？

Question

I am writing ac# winform desktop application that is in contact with a MYSQL database. Of course I cannot leave the database credentials out in the open hard-coded into the application, so where can I store this information so that a nosey customer will have an extremely tough time locating it?

I understand that if someone is very determined to find this information they will most likely do just that, but I want to be able to hide these credentials from the average Joe, leaving me with some peace of mind at the end of the day.

If your answer is to encrypt the credentials, and hard code the encrypted values into the program, please explain which encryption methods to use. Furthermore, where would I store the necessary decryption/encryption keys?

I very much look forward to some interesting responses.

Thank you,

Evan F.

Answer 1

http://www.ezzylearning.com/tutorial.aspx?tid=8067328

Store it in App.Config File.

Check out above tutorial.

You can also check this good article by Microsoft which teach you how to encrypt and retrieve.

http://msdn.microsoft.com/en-us/library/ms254494.aspx

One of Previous Posts

if you have installed Microsoft Enterprise Library, you can easily encrypt/decrypt using its tool as mentioned in this link

http://davidhayden.com/blog/dave/archive/2006/01/23/2744.aspx

http://davidhayden.com/blog/dave/archive/2006/03/02/2870.aspx

Also, after the installation, open the project in studio and right click on the web.config or app.config and you will see the option for the configuration though Enterprise Library. This option is available in Visual Studio 2005 but I cannot see this in Visual Studio 2008 yet. Not sure whether its not compatible with 2008 or I have to follow some installation sequences. I will let you guys know if I come across with any solutions.

This is the link which explains how to work with encryption within studio http://www.pnpguidance.net/Post/EnterpriseLibrary3VisualStudioIntegratedConfigurationEditor.aspx . Read, read & read...

Keep in mind that once you open the .config file you have luxuary of ecrypting each pieces/blocks seperately. Thats the beatuy of it.

For your information I am using Enterprise Library 3.1 which is the latest version and has tonnes of tools that makes your life a breeze. You can download this library at http://msdn2.microsoft.com/en-us/library/aa480453.aspx . Also, look forward for 4.0 at http://www.codeplex.com/entlib

---

Bottom line you can search google along these lines and I am sure it will give you the whole process.