C# + SQL Server 2000 + password in clear text problem

Question

I've got a Windows Application that I use to communicate with a remote SQL Server and whenever it makes a connection it will send the password and username in clear text. For a reference to the codesnippet look here: http://paste.mine.nu/tmp/GetPaste.aspx?paste=109843912717&header=true Is there a way I can ensure that the connection is either encrypted or not sending the password or whatever? I need to distribute this client to people and when I do I don't want them to run around with a sniffer getting my SQL Server username and passwords =/ (I tried to sniff it myself so I know it's sent in clear text)

mibuyt · Answer

Hi You can encrypt the connection string. I extracted this from the msdn article. // (6) Encrypted database connection string is held in the registry private static string GetConnectionString() { // Retrieve the cipher text from the registry; the process account must be // granted Read access by the key's ACL string encryptedString = (string)Registry.LocalMachine.OpenSubKey( @Software\OrderProcessing\) .GetValue(ConnectionString); // Use the managed DPAPI helper library to decrypt the string DataProtector dp = new DataProtector(DataProtector.Store.USE_MACHINE_STORE); byte[] dataToDecrypt = Convert.FromBase64String(encryptedString); return Encoding.ASCII.GetString(dp.Decrypt(dataToDecryptnull)); } Reference http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/THCMCh14.asp Hope it helps. Cheers.

mark 0 · Answer

I believe a common solution is to create a data access assembly that is placed in the GAC which contains a function that returns a dataconnection object. GAC is secure and I don't think the dataconnection is sniffable.