Prevent file from being edit

Question

What's the smartest way to prevent a textfile (eg xml) from getting edit by a user? I need to make sure that the file in which I store the usernames and there privileges for the desktop application can't be simply edited.

Maybe I can generate a certificate of the file and the desktop applications checks this?

I'm using C# in a WinForms app.

Answer 1

You could use File system permissions to prevent editing.

You could use encryption to make editing difficult

You could get a hash value for the file to detect editing.

I think encrypting the file, then decrypting it will be easiest. Though users might still be able to read the contents of the file if they're smart enough. eg reading the plain-text from memory

Answer 2

The simplest way is probably to use a database with username and password authentication.

The smartest is to encrypt it so that the data is not available to them.

However, if a user truly wants access to a file on their machine, they will get it. You can make it so that they cannot read anything useful or make useful edits, but if they want to, they will be able to edit the file.

Answer 3

Since your aim is to store users' privileges directly in an XML file, you need a level of security beyond just preventing users from editing the file. Even if you could (hypothetically) impose some restriction at the operating system level against editing the file, any administrative user could just edit the file on a different computer and then overwrite your protected version.

Thus, you have to assume that users can edit the file. The only recourse you have is to be able to identify when they have, and ignore their edits.

The approach you suggest of creating a certificate sounds exactly right. You could either compute a hash for the entire file, or could do so on a user-by-user basis (whichever makes most sense in your context), in either case using a private or secret key to ensure that someone editing the file cannot simply recompute the hash.

Answer 4

IMHO you can not guarantee no one can edit it, but you can encrypt the file to secure the information.

you can not guarantee as any one can boot the machine using disk start up for example and edit the text file simply.

Answer 5

If you MUST keep that data in a XML textfile you could consider digitally signing it by your application every time it is modified and checking the digital signature when you read the file.

More details on how to sign XML file and how to verify signature .

But I think it's better to just keep that kind of data in different formats - database, encrypted file, application properties...

Answer 6

Personally I don't think XML is the appropriate format for storing secure information in this case. The whole point of XML, compared to binary formats, is that it is human readable/editable. Use some kind of encrypted binary format with a known hash/crc that tells you if it's been interfered with if you want total security.

Answer 7

You can use cryptography, but use the DPAPI built into Windows as you will also have to store the encryption key safely, which again is another hassle.

The benefit of using DPAPI is that it uses a key unique to the user or computer, and is never disclosed, even to the programmer! But if you move the file onto another user's profile or computer, it will be unreadable.