Re: Securing app.config / web.config

Right. There is no such thing as client security. You will not be able to
hide a connection string's password from an determined hacker.

Either use integrated authentication or shield database details using a middle
tier.

-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

Thanks Dominick,

So, as far as I understand the configuration protection is olny a good
solution for web applications because it secures web.config contets
for remote viewing attacks and it's assumed that direct access to the
server in orde to run commands like aspnet_iisreg or accessing key
containers is secure. If I'm switching to a desktop application ... do
I'll have to secure app.config "all by myself"?