Printable View
Hello, I have a WebBrowser on my form and I want to store the user password which is entered in a textbox for logging in a site. I've searched the net a lot. I found some things about hashing and encrypting however I couldn't make any of them work.
visual basic store password securely -database
This search phrase didn't give me results I needed. Please help me.
I also want to know if it's right thing to store some settings like usernames or passwords in an xml or text file.
It depends on what level of security you want. Any secure data is vulnerable and if you want to protect sensitive data, I wouldn't store passwords at all. Personally I'd use a hash. Hash the password, store it. When the user enters a password, hash it and compare against the stored version. This however has vulnerability too, simply because the user will type their password and how do you know there isn't a key logger in place?
For low or zero risk sites, like a forum for example, where there is no 'loss', a hash is your best option. For medium to high risk sites, I wouldn't code it at all, it'd be safer to use a commercial app like LastPass which has high grade protection in place.
Thank you for your reply. I tried this as shown on https://msdn.microsoft.com/tr-tr/library/ms172831.aspx
But I'm getting error:Code:Imports System.Security.Cryptography
Public NotInheritable Class TestClass
Private TripleDes As New TripleDESCryptoServiceProvider
Private Function TruncateHash(
ByVal key As String,
ByVal length As Integer) As Byte()
Dim sha1 As New SHA1CryptoServiceProvider
' Hash the key.
Dim keyBytes() As Byte =
System.Text.Encoding.Unicode.GetBytes(key)
Dim hash() As Byte = sha1.ComputeHash(keyBytes)
' Truncate or pad the hash.
ReDim Preserve hash(length - 1)
Return hash
End Function
Sub New(ByVal key As String)
' Initialize the crypto provider.
TripleDes.Key = TruncateHash(key, TripleDes.KeySize \ 8)
TripleDes.IV = TruncateHash("", TripleDes.BlockSize \ 8)
End Sub
Public Function EncryptData(
ByVal plaintext As String) As String
' Convert the plaintext string to a byte array.
Dim plaintextBytes() As Byte =
System.Text.Encoding.Unicode.GetBytes(plaintext)
' Create the stream.
Dim ms As New System.IO.MemoryStream
' Create the encoder to write to the stream.
Dim encStream As New CryptoStream(ms,
TripleDes.CreateEncryptor(),
System.Security.Cryptography.CryptoStreamMode.Write)
' Use the crypto stream to write the byte array to the stream.
encStream.Write(plaintextBytes, 0, plaintextBytes.Length)
encStream.FlushFinalBlock()
' Convert the encrypted stream to a printable string.
Return Convert.ToBase64String(ms.ToArray)
End Function
Public Function DecryptData(
ByVal encryptedtext As String) As String
' Convert the encrypted text string to a byte array.
Dim encryptedBytes() As Byte = Convert.FromBase64String(encryptedtext)
' Create the stream.
Dim ms As New System.IO.MemoryStream
' Create the decoder to write to the stream.
Dim decStream As New CryptoStream(ms,
TripleDes.CreateDecryptor(),
System.Security.Cryptography.CryptoStreamMode.Write)
' Use the crypto stream to write the byte array to the stream.
decStream.Write(encryptedBytes, 0, encryptedBytes.Length)
decStream.FlushFinalBlock()
' Convert the plaintext stream to a string.
Return System.Text.Encoding.Unicode.GetString(ms.ToArray)
End Function
Sub TestEncoding()
Dim plainText As String = InputBox("Enter the plain text:")
Dim password As String = InputBox("Enter the password:")
Dim wrapper As New TestClass(password)
Dim cipherText As String = wrapper.EncryptData(plainText)
MsgBox("The cipher text is: " & cipherText)
My.Computer.FileSystem.WriteAllText(
My.Computer.FileSystem.SpecialDirectories.MyDocuments &
"\cipherText.txt", cipherText, False)
End Sub
Sub TestDecoding()
Dim cipherText As String = My.Computer.FileSystem.ReadAllText(
My.Computer.FileSystem.SpecialDirectories.MyDocuments &
"\cipherText.txt")
Dim password As String = InputBox("Enter the password:")
Dim wrapper As New TestClass(password)
' DecryptData throws if the wrong password is used.
Try
Dim plainText As String = wrapper.DecryptData(cipherText)
MsgBox("The plain text is: " & plainText)
Catch ex As System.Security.Cryptography.CryptographicException
MsgBox("The data could not be decrypted with the password.")
End Try
End Sub
End Class
Error 3 Reference to a non-shared member requires an object reference. ... \Form1.vb
I edited that microsoft class to be more useable.
Here's the class file.
Code:Imports System.Security.Cryptography
Public NotInheritable Class Simple3Des
Private TripleDes As New TripleDESCryptoServiceProvider
Private Function TruncateHash(ByVal key As String, ByVal length As Integer) As Byte()
Dim sha1 As New SHA1CryptoServiceProvider
' Hash the key.
Dim keyBytes() As Byte =
System.Text.Encoding.Unicode.GetBytes(key)
Dim hash() As Byte = sha1.ComputeHash(keyBytes)
' Truncate or pad the hash.
ReDim Preserve hash(length - 1)
Return hash
End Function
Sub New(ByVal key As String)
' Initialize the crypto provider.
TripleDes.Key = TruncateHash(key, TripleDes.KeySize \ 8)
TripleDes.IV = TruncateHash("", TripleDes.BlockSize \ 8)
End Sub
Private Function EncryptData(ByVal plaintext As String) As String
' Convert the plaintext string to a byte array.
Dim plaintextBytes() As Byte =
System.Text.Encoding.Unicode.GetBytes(plaintext)
' Create the stream.
Dim ms As New System.IO.MemoryStream
' Create the encoder to write to the stream.
Dim encStream As New CryptoStream(ms,
TripleDes.CreateEncryptor(),
System.Security.Cryptography.CryptoStreamMode.Write)
' Use the crypto stream to write the byte array to the stream.
encStream.Write(plaintextBytes, 0, plaintextBytes.Length)
encStream.FlushFinalBlock()
' Convert the encrypted stream to a printable string.
Return Convert.ToBase64String(ms.ToArray)
End Function
Private Function DecryptData(ByVal encryptedtext As String) As String
' Convert the encrypted text string to a byte array.
Dim encryptedBytes() As Byte = Convert.FromBase64String(encryptedtext)
' Create the stream.
Dim ms As New System.IO.MemoryStream
' Create the decoder to write to the stream.
Dim decStream As New CryptoStream(ms,
TripleDes.CreateDecryptor(),
System.Security.Cryptography.CryptoStreamMode.Write)
' Use the crypto stream to write the byte array to the stream.
decStream.Write(encryptedBytes, 0, encryptedBytes.Length)
decStream.FlushFinalBlock()
' Convert the plaintext stream to a string.
Return System.Text.Encoding.Unicode.GetString(ms.ToArray)
End Function
Public Function Decode(cipher As String) As String
Try
Return DecryptData(cipher)
Catch ex As CryptographicException
Throw New Exception(ex.Message)
End Try
End Function
Public Function Encode(txt As String) As String
Try
Return EncryptData(txt)
Catch ex As CryptographicException
Throw New Exception(ex.Message)
End Try
End Function
End Class
To use it.
call the Decode, and Encode functions.
Here;s an example.
http://i.imgur.com/3PWu9hu.pngCode:Module Module1
Dim Simple As New Simple3Des("RandomKey45") 'This is the Key
Sub Main()
Dim myName As String = "Toph"
Dim encodedName As String = Simple.Encode(myName)
Console.WriteLine("Name: " & myName)
Console.WriteLine(myName & " encoded is : " & encodedName)
Console.WriteLine()
Console.WriteLine(encodedName & " decoded is : " & Simple.Decode(encodedName))
Console.ReadLine()
End Sub
End Module
it should be hashed...not encrypted. Hashes are one way. They enter their password, you hash it, you store it in the db. They want to login, they enter their password, you hash it, then compare the TWO HASHED VALUES. There's no decrypting involved.
https://www.google.com/webhp?es_th=1...assword+vb.net
-tg
Oh my bad. I didn't even read his thread in context. I just saw the microsoft code he was having troubles with and tried to resolve it.Quote:
Originally Posted by techgnome
At last I found a working example: How to Get MD5 Hash From String-VBForums Example
Thanks for the helps.
MD5 hashes are also not good because you can lookup rainbow tables to find the word each hash belongs to. MD5 is outdated.
I really so not think zero cool is looking to hack this project. Let's not go to mental.
Out of complete curiosity why have you used windows 95 paint to hide your profile name?Quote:
Originally Posted by Toph
Ahaha. It's a habit. I use Lightshot desktop application to do it not MS paint lool.Quote:
Originally Posted by ident
That's why you shouldn't use passwords in the firstplace but use passphrases the longer the better. I cringe when a website tells me my password can only be 8-12 characters. I don't use anything less than 24 when I can help it. The longer the better. They're a lot tougher to run rainbow files against because of the shear numbers involved. And they're usually easy (easier) to remember, and they avoid the usual character replacements th@t p30p13 l1k3 t0 d0.Quote:
Originally Posted by Toph
-tg
Seems good. I might try using passphrases. So a pass phrase like...Quote:
Originally Posted by techgnome
"ilikeeatingbaconwitheggs" is good?
Not any more.... ;) But yes... phrases like that.
I actually use a pattern and have a little app that helps generate random combinations... when I need a phrase, I run about 20, find one that I'll remember and use it. Given the number of segments (2-4) and the variation of the sources of the segments, the number of combinations is phenominal. And because it's all random, it's not reflective of my personality, making them even harder to guess. I ended up with PurpleLlamaGoats one time...
-tg