SQL Server Object Explorer password is visible

Question

How make password not visible in SQL Server Object Explorer? (Visual Studio 2013). I search it a lot, but not find. Please Help

Answer 1

As mentioned in the comments, you should not store password as a plain text in your database.

I suggest you to use cryptographic function and store the result in your table.

In SQL:

HASHBYTES('SHA2_512', 'YourPassword')

HASBYTE Function: https://msdn.microsoft.com/en-us/library/ms174415.aspx

You have a good example here :
https://www.mssqltips.com/sqlservertip/4037/storing-passwords-in-a-secure-way-in-a-sql-server-database/

Answer 2

Short answer: this is not possible.

Long answer: Your problem though is not the visibility of the password. It is the recover-ability of the password.

As said by @Arnoud Gastelblum you should hash your password.

Hashing is a one way method of changing a password into a string which is not revertable. This way even if the password string is visible it doesnt make sense and it is not revertable to a real password.

How can i check passwords

As said above, hashing is a one way process. once something is hashed there is no way back. So for checking a password for when someone logs in: you hash the input string someone send to your sever, and then check this hash, with the hash already in the database. If they are not the same, the password is incorrect.

Answer 3

This is a simple helper for hashing password and storing hash value and salt value in DB.

public class PasswordBLL
    {
        public static bool ValidatePassword(UserObjLibrary user, string Password)
        {
            return user.passwordHash == EncodePassword(Password, user.passwordSalt);
        }

        public static int ValidatePassword(string userName, string Password, string ipAddress, string MacAddress)
        {
            UserDAL ud = new UserDAL();
            UserObjLibrary user = ud.Details(userName:userName);
            user.lastActivity_ip = ipAddress;
            user.lastActive_MAC_address = MacAddress;
            if (user != null && user.userId > 0)
                ud.LogInActivity(user);
            if(user == null || user.userId < 1)
                return -1;
            return ValidatePassword(user,Password) ? user.userId : -2;
        }

        public static string GenerateSalt()
        {
            byte[] buf = new byte[16];
            (new RNGCryptoServiceProvider()).GetBytes(buf);
            return Convert.ToBase64String(buf);
        }

        public static string EncodePassword(string pass, string salt)
        {
            try
            {
                byte[] bytes = Encoding.Unicode.GetBytes(pass);
                byte[] src = Convert.FromBase64String(salt);
                byte[] dst = new byte[src.Length + bytes.Length];
                byte[] inArray = null;
                Buffer.BlockCopy(src, 0, dst, 0, src.Length);
                Buffer.BlockCopy(bytes, 0, dst, src.Length, bytes.Length);

                HashAlgorithm algorithm = HashAlgorithm.Create("SHA512");
                inArray = algorithm.ComputeHash(dst);

                return Convert.ToBase64String(inArray);
            }
            catch (Exception ex)
            {
                // This gets thrown if the salt is invalid
                return "--Invalid--";   // Any non empty value is fine to make sure the match fails
            }
        }
    }

And When you add user to DB, generate the one-side encryption

public int Add(UserObjLibrary user)
        {
            UserDAL ud = new UserDAL();
            PasswordBLL pb = new PasswordBLL();
            user.passwordSalt = PasswordBLL.GenerateSalt();
            user.passwordHash = PasswordBLL.EncodePassword(user.password, user.passwordSalt);
            return ud.Add(user);
        }

Validating user credentials when user attempt to login

public static bool Login(string userName, string password, string ipAddress, string MacAddress)
        {
            return PasswordBLL.ValidatePassword(userName: userName, Password: password, ipAddress: ipAddress, MacAddress: MacAddress) > 0;
        }