0

I am currently working on one of my first application that will be distributed, but I am running into a huge problem. With use of dotPeek (http://www.jetbrains.com/decompiler/) I can easily retrieve my login data.

Database insecurity

Of course, converting the password to UTF8 bytes will not slow a hacker down much.

What would be the best strategy to prevent someone from retrieving the login details to the database (or any details at all)?

bas
  • 1,678
  • 12
  • 23
  • 1
    Your app logs directly into a DB over the net? – spender Jul 28 '13 at 22:31
  • well, yes, is there a better way? – bas Jul 28 '13 at 22:31
  • 4
    This scares me immensely. Provide user credentials with restricted abilities and include it in a config file. Or better yet.. put it behind a service (web, tcp, anything). – Simon Whitehead Jul 28 '13 at 22:31
  • Put a service in the middle! – razethestray Jul 28 '13 at 22:32
  • I'd consider exposing access to your databaase via a web-server and only give permission for actions that are appropriate for the logged in user. It would be pretty easy to sniff the wire to extract passwords whatever "encryption" measure you put in place. – spender Jul 28 '13 at 22:33
  • the user credentials are stored in the database, before a user can be logged in I have to check his credentials with the database – bas Jul 28 '13 at 22:34
  • 1
    So make the client call a login method on the server which checks the credentials in the database and returns if the user can be logged in. This is standard practice. Then the service can store the database credentials (in a config file, not hard coded!) – razethestray Jul 28 '13 at 22:36
  • @bas, they aren't *user* credentials if they can be baked into the app -- they are *app* credentials. And needless to say, such credentials absolutely cannot be distributed to arbitrary users. (And more to the point, it is not possible to bake them into an app in a secure fashion. The user must supply them his or herself when logging (perhaps for only the first time.) – Kirk Woll Jul 28 '13 at 22:36
  • 1
    Ah, but perhaps the app credentials allow the app to check the user credentials. This is bad bad bad. Please consider a re-architecting of your data-access using better practices. – spender Jul 28 '13 at 22:37
  • what are these better practices? What are my options? That's basically what my question is about. I know this is bad practice. – bas Jul 28 '13 at 22:38
  • Don't expose your database to the web. Expose it to a web-app living on a webserver, then expose the webserver to the web. Have your app talk to the webserver using credentials that belong to the user, not the app (i.e. have them create an account). – spender Jul 28 '13 at 22:41
  • This is a duplicate of http://stackoverflow.com/questions/442862/how-can-i-protect-mysql-username-and-password-from-decompiling – bas Jul 29 '13 at 10:11

1 Answers1

2

The simpliest way - you can use tools from System.Security.Cryptography namespace to encrypt your credentials and then use any obfuscator to make decription process little harder.

But it's only question of time when someone recovers it.

The right way - to hide your database behind web service with public API. It requires more effort but will reduce security riscs significantly.

dmay
  • 1,340
  • 8
  • 23
  • 1
    This seems like a good guide for creating a secure api with REST http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication/ – bas Jul 28 '13 at 22:48