Converting VARBINARY back to a string

[C.]

Hey all,

I'm dealing with a legacy ASP app, and I believe to prevent passwords
from being casually observed in the database, the developer converted
the password to VARBINARY:

qry = "UPDATE Users SET Password = CONVERT( VARBINARY, '" &
newPassword & "' ), "

***SNIP****

I now have to ensure those passwords conform to our new security
policy before a migration. How does one convert a VARBINARY type back
to a string in C#?

 

[C.]

Silly me, I figured out that i should simply do a reverse conversion
as I pull the field out. Move along, nothing to see here.

 

[Jeff Johnson]

I'm dealing with a legacy ASP app, and I believe to prevent passwords
from being casually observed in the database, the developer converted
the password to VARBINARY:

qry = "UPDATE Users SET Password = CONVERT( VARBINARY, '" &
newPassword & "' ), "

***SNIP****

I now have to ensure those passwords conform to our new security
policy before a migration. How does one convert a VARBINARY type back
to a string in C#?

What is the data type of the Password column?

 

[Patrice]

Hello,

qry = "UPDATE Users SET Password = CONVERT( VARBINARY, '" &
newPassword & "' ), "

Just the other way round...

Try :

DECLARE @t VARCHAR(100)
DECLARE @b VARBINARY(100)
SET @t='Some text...'
SET @b=CONVERT(VARBINARY(100),@t)
SELECT @b,CONVERT(VARCHAR(100),@b)

Are you sure this is how it was done ? If yes it looks quite a naive
protection measure. Someone knownledgable enough to get at the db will
likely have no problem converting back such a value to text...

If you are currently taking additional safety measures you may want to try :
http://anastasiosyal.com/archive/2008/04/23/quick-tip-use-hashbytes-to-create-a-hash-in-tsql.aspx
and make sure to check the comments for a quick yet quite up to the point
overview of password "hashing"...

 

[Arne Vajhøj]

I'm dealing with a legacy ASP app, and I believe to prevent passwords
from being casually observed in the database, the developer converted
the password to VARBINARY:

qry = "UPDATE Users SET Password = CONVERT( VARBINARY, '"&
newPassword& "' ),"

***SNIP****

I now have to ensure those passwords conform to our new security
policy before a migration. How does one convert a VARBINARY type back
to a string in C#?

1) You should use Parameters and then you can set a byte array.

2) You should preferably not store the password at all but
instead store a hash (like SHA-256) of it - or at least
encrypt it - what you do is nothing.

Arne