We have encrypted the connection string in web.config, however if you look at
ASP.NET Configuration Settings in IIS Manager, the connection string
including the password is there in clear text.

Does anyone know how to avoid this?
Thanks!

The configuration plumbing in the CLR decrypts settings as code calls the
APIs to read the values. This allows the code to not know/care that a value
was encrypted. The UI you're referring to calls the same APIs. Why is this
an issue? Presumably an admin is the only one that would have access to the
IIS config tool, and the admin is the person you're supposed to trust to
configure your app.

-Brock
http://staff.develop.com/ballen

Agreed that it is not a huge security risk. However we do have customers who
would find passwords displayed in clear text totally unacceptable wherever
they're displayed

"Brock Allen" wrote:

This would be a great situation to provide product feedback to MSFT:

http://msdn.microsoft.com/productfeedback/

-Brock
http://staff.develop.com/ballen