How to hide userid/password in db connection string?

[Kelly]

I have a db connection that uses a userid/passwd that will remain static and
the application user does not need to know/change it. However, by hardcoding
it, the plain text is available both in the Sourcecode and likely easily
parsed out of the binary.

For reference, the application is a service running in the background. It
has no UI.

So, what are some solutions to this problem? Where should the
userid/password be stored so that it is secure?

Thanks.

[Mickey Williams [C# MVP]]

Store the connection string in a config file, and use DPAPI to encrypt the
sensitive bits. Here's a link to an MSDN mag article that's a good starting
point:
http://msdn.microsoft.com/msdnmag/is...a/default.aspx

--
Mickey Williams
Author, "Visual C# .NET Core Ref", MS Press
www.neudesic.com
www.servergeek.com

"Kelly" <co*******************@hotmail.com> wrote in message
news:F6**********************************@microsof t.com...

I have a db connection that uses a userid/passwd that will remain static
and
the application user does not need to know/change it. However, by
hardcoding
it, the plain text is available both in the Sourcecode and likely easily
parsed out of the binary.

For reference, the application is a service running in the background. It
has no UI.

So, what are some solutions to this problem? Where should the
userid/password be stored so that it is secure?

Thanks.