Secure password storing

[Gordon Knote]

Hi

In my application I need to store a password the user enters (unfortunately not a hash of it, but the password as a plaintext string). Is there any secure way to do so (by Visual Basic .NET)

Thanks
Gordon

[Frank Eller [MVP]]

Hi Gordon,

In my application I need to store a password the user enters
(unfortunately not a hash of it, but the password as a plaintext
string).
Why not the Hash ...? That's the safest way ...
Is there any secure way to do so (by Visual Basic .NET)?
The only way to store something securely is to encrypt it. You can never
save a password as plain text and be on the secure site. But there'S
possiblilities in .NET to encrypt and decrypt passwords (encrypt it before
it is stored, decrypt it before you check it ...). Looak at the
System.Security .Cryptography namespace.

Regards,

Frank Eller
www.frankeller.de
Thanks
Gordon

[Gordon Knote]

Hi

thanks for your answer. The reason why I can't store a hash is that the password is stored only for the user's comfort so that he doesn't have to enter it again and again. Unfortunately, the server the client talks to just wants the password in plaintext, not hashed...so there's no choice for me
Sure, encrypting is quite a good idea, but with which key? How does Microsoft solve the problem (e.g. in the internet explorer, or passport...)

Thanks so fa
Gordon

[Elp]

"Gordon Knote" <an*******@disc ussions.microso ft.com> wrote in message
news:0C******** *************** ***********@mic rosoft.com...

Hi,

thanks for your answer. The reason why I can't store a hash is that the password is stored only for the user's comfort so that he doesn't have to
enter it again and again. Unfortunately, the server the client talks to just
wants the password in plaintext, not hashed...so there's no choice for me. Sure, encrypting is quite a good idea, but with which key? How does

Microsoft solve the problem (e.g. in the internet explorer, or passport...)?

Well, don't you have any way to modify the Server application? :-)

If not, then you're facing a big problem here. You can for sure encrpyt it
with a symetric key, there are loads of free libraries out there that will
do that for you. However, the problem remains the same, where and how would
you store the key? I believe (i hope at least) that IE or the Microsoft
passport system are only storing hash of the passwords.

You can always go the easy way by using symetric encryption and do some
dirty things such as derivating the key from the processor serial number or
hardcoding it in your obfuscated code but all that will not discourage
anybody who really want to break your system. This is not in any way
something called security.

Sorry not to provide THE answer but i can suggest you to have a look at the
archives of this newsgroup: microsoft.publi c.dotnet.securi ty or even post
your question there. You'll have maybe more usefull advices than here.