Encrypting Passwords in a .NET app.config File
I’ve been contributing to the Witty project lately. I’m a fan of Twitter, and it’s nice to work on a popular WPF application with some hotshot coders including a WPF pro like Alan Le. Lately, I noticed that we were storing the user’s password in plaintext application config file:
<surroundings name=”password” serializeas=”string”> <value>oops-we-stored-the-password-in-plaintext</value> </setting>
So, yeah, that’s less than ideal. Foolishly, I volunteered to fix it. There’s plenty of information on encrypting ASP.NET configuration settings in web.config files, but encrypting settings in a desktop application isn’t as well documented. Here’s what I came up with.
DPAPI, Papi!
The best way to encrypt configuration settings is with DPAPI, the Data Protection Application Programmer’s Interface:
This Data Protection API (DPAPI) is a pair of function calls that provide OS-level data protection services to user and system processes. By OS-level, we mean a service that is provided by the operating system itself and does not require any additional libraries. By data protection, we mean a service that provides confidentiality of data through encryption. Since the data protection is part of the OS, every application can now secure data without needing any specific cryptographic code other than the necessary function calls to DPAPI.
That sounds pretty good. But is it secure? Let’s ask old man Wikipedia:
The keys used for encrypting the user’s keys are stored under “%USERPROFILE%\Application Data\Microsoft\Protect\{SID}”, where {SID} is the security identifier of that user. The DPAPI key is stored in the same file as the master key that protects the users private keys. It usually is 40 bytes of random data. DPAPI doesn’t store any persistent data for itself; instead, it simply receives plaintext and returns cryptext (or vice-versa).
PetroChina Co. Ltd. (PTR) Stock — Seeking Alpha
Hedge Fund Jobs · Get Email Alerts · Submit Article · Wall Street Breakfast · Jim Cramer · Latest Transcripts · Interviews. PetroChina Co. Ltd. (PTR) …
DPAPI security relies upon the system’s ability to protect the Master Key and RSA private keys from compromise, which in most attack scenarios is most highly reliant on the security of the end user’s credentials. Particular data binary large objects can be encrypted in a way that salt is added and/or an external user-provided password (aka “Strong Key Protection”) is required. The use of a salt is a per-implementation option - i.e. under the control of the application developer - not controllable by the end user or IT professional.
PTR Quote - PTR Stock Quote - PetroChina Co. Ltd. (ADS) Stock …
Ltd. (ADS) (PTR). NYSE. Comprehensive Quote:. 04/11/08 04:02 PM EDT … Ltd. (ADS) Stock Quote - PTR Stock Price. WSJ Digital Network: …
PTR Programs - Get Paid Online
Earn Money Online with PTR and other *Get Paid To* Programs.
Obama minute
Yeah, I didn’t read it either. I did check the footnotes and saw that nobody’s bragging about yoinking data out of it, though. And it has to be better than storing passwords in plaintext. So, awesome, let’s go for it!
PTR Baler and Compactor Company
PTR Baler & Compactor is recognized as a source of high quality service and manufacturer of balers and compactors manufactured in the United States for …
The Nuclear Option: Encrypt The Whole Thing
The easiest way to deal with the problem is to just encrypt the entire section. That’s because the ConfigurationSection knows how to protect itself, like so:
protected override blankness onstartup(startupeventargs e) { // lots of other important stuff here… encryptconfigsection(”usersettings/witty.properties.settings”); form.onstartup(e); } private void encryptconfigsection(string sectionkey) { configuration config = configurationmanager.openexeconfiguration(configurationuse
PTR - Wikipedia, the free encyclopedia
Physikalisch-Technische Reichsanstalt · PTR Record - Pointer record, a type of DNS record. … Retrieved from "http://en.wikipedia.org/wiki/PTR" …
Related posts: Post office hours april 15th, Lisa raye, Snam, The kanzius machine, Lewica