Cliënt - Server connection

[gonzalioz]

Hi,

Don't know if this is exactly the right board for this, but here it goes:

I have to make an app that users install on there pc once and from then on certain data can be obtained from a database (doesn't matter what) without the user having to type some password or something.

This is my idea:

First time installation:
1. Cliënt starts setup.exe
2. Cliënt types in username and password
3. Webservice checks username and password
4. If correct, webservice returns a KEY and a UserID
5. Cliënt stores this key and UserID into the register
Installation done


Run App:
1. Cliënt starts application
2. Cliënt app sends userID to webservice
3. Webservice encrypts a number (75 for example) with the key that belongs to this user and sends this back.
4. Cliënt app decrypts the number with his key and sends the decrypted number back to the webservice.
5. The webservice checks if the number that is returned is equal to the number he send.
6. If so, cliënt app has access...


Using this method, the cliënt only has to give his username and password once and from then on can use the application from anywhere without constantly logging in or something.

Problem is, I could make some simple key. Like x12342134 or -13414312 but this is not really safe.
Who knows of a relativly simple but still quite easy algorithm which I can write in vb.net to use to encrypt the number?


[EDIT] Or maybe it's a good idea to just just some kind of formula like: number * 1231 / 2342 - 234234 * 12312 + 34124
* 1231 / 2342 - 234234 * 12312 + 34124 would then be the "KEY" of a user.

[chris128]

One thing you have to remember with .NET is that no matter how strong your encryption algorithm is, someone can just dissasemble your program using something like Reflector and see pretty much all of your source code so they can easily reverse or copy the algorithm. The only way to TRY to prevent this is to use an 'obfuscation' program to encrypt your source code but as many people will tell you - this just makes it a bit harder for someone to view your code, not impossible.