2

I have an Application that needs to store User Info such as their Username and there score and etc... I have selected LocalApplicationData of the Environment.SpecialFolder Enumeration. but I can access the directory for my application manually using file explorer and can edit or delete the file that can prove as a weak spot for the application and the users may be able to mess with my application.

So, Is there any directory that I can write to using code that the user will not be able to access it. tnx

Walid Mashal
  • 342
  • 1
  • 12

3 Answers3

4

Is there any directory that I can write to using code that the user will not be able to access it.

No. An application run by a user account has the same privileges and permissions as that user. Therefore, there is no way that the application could do something the user couldn't do on his own.

If the data you need to store is intended to be browsed or modified by the user, it should go in Environment.SpecialFolder.Personal.

Otherwise, data should be stored in either Environment.SpecialFolder.ApplicationData (if it should roam with the user account) or Environment.SpecialFolder.LocalApplicationData (if it should not roam with the user, and instead should be limited to the local machine).

Yes, the user can get into these folders and destroy the data. By doing so, they run the risk of breaking your application. You can't secure yourself from yourself.

Develop a "repair" utility that can recover from the damage by recreating the necessary files on startup of your application if necessary.

Cody Gray - on strike
  • 239,200
  • 50
  • 490
  • 574
2

As your application is running with your users privileges, there is no place your application can access that your user would not be able to access.

Your only option is to use encryption so your user cannot tamper with the file easily once it's written. But even then... what you did with the user's privileges can be undone by the user with the same privileges. You can only make it hard enough so he or she won't bother.

nvoigt
  • 75,013
  • 26
  • 93
  • 142
1

You can not prevent use open the file, but have some method to check if a file is being modified by user.

You can save it at Registry, or if your data is big, you can encrypt it before save to file. When you encrypt data, user can not know which infomartion it contains, and if user open the file and modify it, the data become invalid and you can know it is modified.

Community
  • 1
  • 1
NoName
  • 7,940
  • 13
  • 56
  • 108