Ideas on protecting My.Settings entries connection strings, etc

[AlexW]

I'm very surprised MS would allow app and user config files to be
easily read via text editors to view passwords, server names etc
without including encryption support.

I've searched the groups with no real good solution or at least one
that a few peers seem to value.

Trusted connection is out of the question due to the nature of the
application so a sql server user account is needed. Anyway, I need
feedback on this methodology.

If I elect to encrypt the default values and future values for the
user config entries and have the app at runtime encrypt and decrypt
values and my encryption key is hardcoded. Would this at least be
somewhat secure since the key is compiled into the exe, I understand
that some savvy nerd could reverse engineer the exe, but obviously I'm
not writing something for the defense department. It's just way too
easy for a user to locate the config files and snoop up the server and
catalogs names, not to mention the passwords etc..

Thanks for any help. Happy New Year.

Alex.

 

[Ravi Bhavnani]

I found this article on encrypting connection strings (and other sensitive
info) helpful.

Encrypt Connection Strings AppSettings and Web.Config
http://davidhayden.com/blog/dave/archive/2005/11/17/2572.aspx

Hope this helps!

/ravi

 

[Family Tree Mike]

You don't (as a developer) need to necessarily know what the users decryption
key is. You can use something specific to the computer such as the computer
name and user name concatinated.

 

[Peter Duniho]

I'm very surprised MS would allow app and user config files to be
easily read via text editors to view passwords, server names etc
without including encryption support.

In addition to the replies already given, it's worth pointing out that
this isn't about what "MS would allow". No one told you to store
sensitive information in the config files, nor are the config files
intended to be secure storage. They are simply a convenient place to put
information.

There's no point in being surprised that Microsoft uses encrypted text
files for this purpose; it's no different than the registry or .ini files
(to name a couple of previous system-supported settings storage
facilities), neither of which are any more secure than the XML config
files.

Pete

 

[AlexW]

Thanks for the replies everyone.