Encrypting the connection string in ASP.NET V2.0

re: Encrypting the connection string in ASP.NET V2.0

don — Thu, 05 Apr 2007 14:37:51 GMT

Mr.Simplistic:

You have a point but wouldn't that require write access to the directory where looking at a web.config to get an unencrypted connection string would only require read access.

Also, if you are using source control and have an unencrypted connection string in your web.config then someone only needs to view the checked in source to get the info.

I think it is not a solution to the entire problem, just common sense. Like locking a door is a good idea even if it won't stop a serious thief.

re: Encrypting the connection string in ASP.NET V2.0

Flure — Fri, 02 Mar 2007 13:44:43 GMT

Hello,

http://wavefrontguidedlasik.site.cx

Thanks ;) Good luck!!!

how i create a connection string in web config in asp.net

abhishek — Mon, 18 Dec 2006 06:47:33 GMT

i have create a connection string in asp.net but i required it reflect in all the pages what can i do

Encryptage de fichier de config

Cyril 's Blog — Sat, 04 Nov 2006 01:59:42 GMT

Les fichiers de configuration d'une application .net est un fichier XML donc lisible et compréhensible

More on encrypting parts of web.config

Visual Studio 2005/SQL Server 2005 Community Launch Event — Tue, 22 Aug 2006 14:57:02 GMT

Just a few more notes on encrypting parts of web.config: 1.0/1.1 through hotfix: http://support.microsoft.com/default.aspx?scid=kb;en-us;3292902.0:http://channel9.msdn.com/wiki/default.aspx/Channel9.HowToEncryptConfigurationSectionsUsingRsaInAspNet20?diff=ysee..

re: Encrypting the connection string in ASP.NET V2.0

Mr.Simplistic — Sun, 20 Aug 2006 05:51:46 GMT

This is probably going to be a very silly question as I am still learning / not quite up to speed with the encryption side of things, but...

As I understand, the whole point of encrypting web.config sections (including connection strings) is to avoid having a plain-text password "exposed", should someone gains file access to the application directory.

However, couldn't that someone simply put an aspx page to display connection string in plain text after getting the system to decrypt it, regardless of where any of the keys are stored?

The only way I can see this being avoided is hard-coding an entropy of some kind, using custom decryption - e.g. at logon authentication, manually accessing the database or creating a custom role and memebership providers with manual interaction with database...