1

I am creating a windows WPF application in c# using Visual Studio Community 2013 and mySQL. I'm quite new too all of this, so please excuse me if I am not making sense.

I have searched for answers on google and here on stack-overflow and have found similar questions but have not found any satisfactory answers.

I currently (for development) have the username and password for the mySQL connection stored in the settings.settings file (in plain-text) but obviously this is no good for production as it is unsecure. I am unsure how to best implement the password security.

I would usually just salt/hash the password and authenticate the user against the hash but as I need to connect to mySQL that would not work as I need to pass the password in the connection string (or is there another way?)

I wouldn't mind to have a 'Remember Password' option but I'm not opposed to requiring the user to enter their password on entry each time they open the app.


There are various ways I can see of programming this:

  1. Store the password in plain text and send to mySQL each time I make a query. This is obviously not secure

  2. Encrypt and store the password and unencrypt/send to mySQL each time I make a query. This is slightly less unsecure but still not great

  3. Take the entered password, authenticate against mySQL, discard the password and keep the mySQL session open for the duration of the time that the application is running.

  4. Salt/Hash the password to authenticate the user and once the user is authenticated connect to the database using hard coded credentials. Reverse engineering this application would give anyone the SQL credentials

  5. Same as #4 but store an encrypted password in the database with the hash (encrypt a different password to their entered one) and unencrypt/send to mySQL in plain text. Is sending a plain text password over a local network unsecure?

  6. A far cleverer way doing the entire thing that I couldn't think of. This is probably the right answer

So, which is it?

Thanks in advance for any answers.

MarkR
  • 19
  • 3
  • Already answered in for example http://stackoverflow.com/questions/22435561/encrypting-credentials-in-a-wpf-application – Norbert Jun 28 '15 at 18:43
  • As I understand this would encrypt the password that the user entered that I would then unencrypt and send in plain-text in the connection string. Is this a secure way to go about it? and isn't encryption vulnerable to rainbow table cracking? – MarkR Jun 28 '15 at 18:59
  • You could protect your connection using SSL: https://dev.mysql.com/doc/refman/5.1/en/ssl-connections.html – Norbert Jun 28 '15 at 23:00

0 Answers0