Re: Securing app.config / web.config

#1

Right. There is no such thing as client security. You will not be able to
hide a connection string's password from an determined hacker.

Either use integrated authentication or shield database details using a middle
tier.

-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

Quote:

Thanks Dominick,

So, as far as I understand the configuration protection is olny a good
solution for web applications because it secures web.config contets
for remote viewing attacks and it's assumed that direct access to the
server in orde to run commands like aspnet_iisreg or accessing key
containers is secure. If I'm switching to a desktop application ... do
I'll have to secure app.config "all by myself"?

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Re: Securing app.config / web.config

Dotnet Security microsoft.public.dotnet.security

Re: Securing app.config / web.config - 12-04-2007 , 04:36 PM