Hi
In my application I need to store a password the user enters (unfortunately not a hash of it, but the password as a plaintext string). Is there any secure way to do so (by Visual Basic .NET)
Thanks
Gordon
3  2005 
Hi Gordon,
In my application I need to store a password the user enters
(unfortunately not a hash of it, but the password as a plaintext
string).
Why not the Hash ...? That's the safest way ...
Is there any secure way to do so (by Visual Basic .NET)?
The only way to store something securely is to encrypt it. You can never
save a password as plain text and be on the secure site. But there'S
possiblilities in .NET to encrypt and decrypt passwords (encrypt it before
it is stored, decrypt it before you check it ...). Looak at the
System.Security .Cryptography namespace.
Regards,
Frank Eller
www.frankeller.de
Thanks
Gordon
Hi
thanks for your answer. The reason why I can't store a hash is that the password is stored only for the user's comfort so that he doesn't have to enter it again and again. Unfortunately, the server the client talks to just wants the password in plaintext, not hashed...so there's no choice for me
Sure, encrypting is quite a good idea, but with which key? How does Microsoft solve the problem (e.g. in the internet explorer, or passport...)
Thanks so fa
Gordon
"Gordon Knote" <an*******@disc ussions.microso ft.com> wrote in message
news:0C******** *************** ***********@mic rosoft.com... Hi,
thanks for your answer. The reason why I can't store a hash is that the
password is stored only for the user's comfort so that he doesn't have to
enter it again and again. Unfortunately, the server the client talks to just
wants the password in plaintext, not hashed...so there's no choice for me. Sure, encrypting is quite a good idea, but with which key? How does
Microsoft solve the problem (e.g. in the internet explorer, or passport...)?
Well, don't you have any way to modify the Server application? :-)
If not, then you're facing a big problem here. You can for sure encrpyt it
with a symetric key, there are loads of free libraries out there that will
do that for you. However, the problem remains the same, where and how would
you store the key? I believe (i hope at least) that IE or the Microsoft
passport system are only storing hash of the passwords.
You can always go the easy way by using symetric encryption and do some
dirty things such as derivating the key from the processor serial number or
hardcoding it in your obfuscated code but all that will not discourage
anybody who really want to break your system. This is not in any way
something called security.
Sorry not to provide THE answer but i can suggest you to have a look at the
archives of this newsgroup: microsoft.publi c.dotnet.securi ty or even post
your question there. You'll have maybe more usefull advices than here. This thread has been closed and replies have been disabled. Please start a new discussion. Similar topics | |
by: Lefevre, Steven |
last post by:
I'm working on a website/database deal, and right now I'm designing the
security model.
It's using LAMP(HP), so all the tricks are going to be through PHP.
First off, this will be behind a firewall with SSL encryption. We may also
setup some kind of VPN tunneling.I'll be ignoring other security details
that don't apply to the problem at hand, but please feel free to suggest.
I'm going to have users enter a username and password, with...
|
by: Shabam |
last post by:
I'm developing an application and want to have the "remember me" feature, so
that users don't have to log back in again in the next visit.
The problem here is, what happens if the user's cookie is stolen? Or, what
prevents someone from figuring out the algorithm to the cookie session
string?
I've thought of using a random string (stored in the database) that's
written to the user's cookie once he's logged in. Since it's random there...
|
by: COHENMARVIN |
last post by:
I have a sql server database hosted by an ISP. It has credit card
fields. I want to make the database secure.
My asp.net pages refer to the database as follows:
strConnection =
ConfigurationSettings.AppSettings;
Which means they get the connectionstring for the database from a
web.config file.
The web.config file has the following tags:
<appSettings>
<add key="ConnectionInformation"
|
by: Gordon Knote |
last post by:
Hi
In my application I need to store a password the user enters (unfortunately not a hash of it, but the password as a plaintext string). Is there any secure way to do so (by Visual Basic .NET)
Thanks
Gordon
|
by: Alvaro G. Vicario |
last post by:
I’m writing a web application that needs to keep passwords in a database.
These passwords are for third-party services and are different from the
regular login passwords.
I don’t like storing this sensitive info as plain text and one-way hashing
is not an option because I need the actual passwords. I’ve done some quick
research and it seems that symmetric encryption algorithms (blowfish, AES…)
provide a reasonable solution—I...
| | |
by: Jamey Shuemaker |
last post by:
A2k2 with user-level security and all preventive measures, vis a vis,
Security FAQ enabled or enacted.
I've got three DBs, which due to size constraints can't, or rather,
probably shouldn't be combined. All have front-end on C: drive,
back-end in same folder on network share. All are secured with the same
..mdw.
I'd like to make a master file that gives the user one single jumping
off point to link to the other apps. I can accomplish...
|
by: knal |
last post by:
Hi there,
I'm looking for a secure login script for a sort-of-community site...
(PHP, MySQL, sessions, or maybe something else ... )
I know there are a lot of scripts out there, but none of them really
seem secure, or have other kind of flaws (like IP based login etc.).
Why i'm asking here, is because there's experience out there, and i
hope experience can tell me what my best shot is. I'm aware that i will
very probably have to do...
|
by: Harris Kosmidhs |
last post by:
Hello,
while I'm developing sites for some time I never coded a login form with
security in mind.
I was wondering what guidelines there are.
For my point of view I'm thinking of using md5 passwords (it's an one
way function right?) in db. Is this a correct approach?
|
by: topher23 |
last post by:
I've seen a lot of questions about how to make secure database passwords. I'm going to go over a method of encrypting a password using the MD5 encryption algorithm for maximum security.
First, you will need to download the attached class module (clsMD5.txt) and import it into your database. This class module is the core of what we're about to go over. Thanks to Robert Hubley for writing it - you're my hero!
Next, your database needs a...
|
by: marktang |
last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look !
Part I. Meaning of...
|
by: Hystou |
last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it.
First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
| | |
by: jinu1996 |
last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth.
The Art of Business Website Design
Your website is...
|
by: tracyyun |
last post by:
Dear forum friends,
With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
|
by: agi2029 |
last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own....
Now, this would greatly impact the work of software developers. The idea...
|
by: isladogs |
last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM).
In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules.
He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms.
Adolph will...
|
by: TSSRALBI |
last post by:
Hello
I'm a network technician in training and I need your help.
I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs.
The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols.
I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
|
by: adsilva |
last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
| | |
by: bsmnconsultancy |
last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...
| |
