Hacking Question

[Hawk]

Hi,

Here is something I have been thinking about. Currently, I keep the connection string to the database inside a COM component. This way, if someone hacks into my computer, they cannot get the userid and password to the database.

I was just curious. If I stored my connection string inside the global.asa or the asp page itself, would that be safe. Can someone hack into my server and steal the global.asa or asp page and view my connection string. At that point, they have my userid and password to access my database.

Thanks

[mendhak]

click here

[mendhak]

More related links (including the above one)
http://www.aspin.com/home/references/security

[Hawk]

Thanks Frogman

[mendhak]

YW, bald eagle.

[msimmons]

but how do you do it?

[JoshT]

Originally posted by Hawk

Here is something I have been thinking about. Currently, I keep the connection string to the database inside a COM component. This way, if someone hacks into my computer, they cannot get the userid and password to the database.

What if they open your COM component in a hex editor? Unless it's encrypted well, they could still see the string.

Global.asa is a plain text file, all they'd need is read access to that on the file system.

[Hawk]

Can you give me an example of basic starting encryption? Do you create this encryption in COM also?

Thanks

[JoshT]

Originally posted by Hawk
Can you give me an example of basic starting encryption? Do you create this encryption in COM also?

Thanks

Use a well known publically tested and proven encryption algorithm - you could buy/make/download a COM based DLL (MS has CAPICOM for free), or you could implement the algorithm yourself. Don't even bother with the little encryption algorithms people like to post to sites like Planet Source Code or here, get the open well known ones (DES, 3DES, or whatever).

[Hawk]

Okie Dokie!

Thanks Josh