Security :: Encrypting/Decrypting A Shared Password At Rest?
Dec 14, 2010
I received some code, a small c# asp.net application which manually posts a shared username/pwd to a 3rd party website for auto-logins from our intranet site. During transit the password is encrypted, but not within the application. Within this application a namevaluecollection is used and the username and password are hard coded. Originally the thought was, who cares if its hard coded because its shared between everyone anyway. Now we want to encrypt the username and password from within the application. I'm not sure the best way to accomplish the goal of making sure the password is encrypted "at rest". Normally I've seen passwords stored and encrypted within a database. I know we'll obviously have to move the password out of the application and store it somewhere else, I'm just not sure where. Do we move the username and pwd to the web.config file? I really am not sure the best way to approach this.
View 1 Replies
Similar Messages:
Apr 22, 2010
I want to encrypt the password entered by the user....how do i go about it?is there any built-in function for it or will i be required to write a code for it?
View 5 Replies
Aug 24, 2010
I have a webApplication in which i want to encrypt the data using Public key and whan it reach to the destination webapplication it will decrypted there with corresponding private key . Is there is any way to creating this pair of key?
View 3 Replies
Feb 18, 2010
I have a problem hopefully someone out there will steer me in the right direction.
I have a web application that I am going to put on a standalone cd - currently the data is "Safe" because the database is in in the app folder and the code is located in the codebehind.
My problem is i'm putting this on a CD as a standalone site, anyone can access the database, or find the XML....
Is there a way to generate an encrypted Database / XML Page, that is complied with the CD, that the program can decrypt and access with a embedded key?
View 1 Replies
May 27, 2010
I would like to encrypt the password and store it in DB. And if user forgots the password and request for password i have to send him a dummy password to his mail id how can i implement this if any code available At the time of registration i have to encrypt or salt the password and save it to DB..
View 1 Replies
May 27, 2010
My problem is that I'm going to have a SQL Server database and website that accesses that database via a hosting provider, most likely GoDaddy.com, using ASP.Net. I need to make sure the connection string in the web.config file is as secure as possible, because the database will actually be storing trivia questions for a game I'm developing, and the clients will be accessing these questions, saving specific state related details, and other details, to the database, so every player that plays the game will have their details stored in this database. I need to ensure hacking is very difficult to accomplish.
From my research it appears as though the only viable solution for your web.config when you've got a hosting account with something like GoDaddy.com is to use SQL Server security to connect to your SQL Server database and place those details in the web.config file. Is this correct? It seems that this is the most likely scenario for most users, because we don't have access to our hosting providers IIS servers in order to use Windows authentication with SQL Server access and then use DPAPI encryption from there.
View 2 Replies
Apr 4, 2011
would please someone guide me how to encrypt and decrypt cookies in Asp.net 2.0.
View 1 Replies
Oct 12, 2010
I have been trying to encrypt password and found a code which is working with Access fine but as i have changed to SQL it is not decoding the encrypted text.. it amazes me..this SQl code is not letting me log on..
[Code]....
Whereas this OlebDB/Access is working fine
[Code]....
View 4 Replies
Feb 22, 2010
I have an asp.net app written in c# and want to log into a shared folder on another server using a different user name and password.
How do I and can you give me some example code to allow me to connect to a shared folder on another server using a different user name and password.
Once connected, I wish to update a txt file
StreamWriter sw = File.AppendText(@\flcy_fluencyDNC_ListsTenantDNC.txt);
sw.WriteLine(tbTel1.Text);
sw.Close();
View 3 Replies
Feb 5, 2011
I have a content-sensitive firewall between my clients and my server. If we exclude SSL solution (it's not available in my case) then I was thinking of a javascript library which encrypts custom fields at client-side and a .NET class decrypts them at server-side. Is there any solution out of the box (maybe a server control) ?
View 2 Replies
Apr 2, 2010
I have an asp.net database which has users table. In this table password is saved as sncrypted. Now, I am creating my own users table. I want to copy user's data from my old table t this table. I can to decrypt old users table password. Which encryption technique is used by default in aspnet database for passwords.
View 2 Replies
Jul 17, 2015
Article : Encrypt and Decrypt Username or Password stored in database
The whole thing works very well but my issue is, after entering and encrypted password how does the user then log into the database?
When a user types in his password, the typed in password will not match the ecnrypted value in the database.
So how do I decrypt what is in the database and compare with what the user typed in and then validate the user.
View 1 Replies
Mar 16, 2011
I am trying to decrypt using an X509 certificate private key. I am using the following function:
[Code]....
View 3 Replies
Jul 22, 2010
I have an external site developed in php that send me a string cripted with this php function:
const SALT = "chiave";
public static function myEncrypt($text)
{
return rawurlencode(base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, self::SALT, $text, MCRYPT_MODE_ECB, mcrypt_create_iv(mcrypt_get_iv_size(MCRYPT_RIJNDAEL_256, MCRYPT_MODE_ECB), MCRYPT_RAND))));
}
and then I need to decrypt this in asp.net.
How can I do?
[Code]....
View 1 Replies
Mar 14, 2011
I can recover my password but when I try to change my password to something a bit easier to remember it gives me:
Password incorrect or New Password invalid. New Password length minimum: 7. Non-alphanumeric characters required: 1.
View 7 Replies
Jun 28, 2013
I would like to connect to a password protected shared location that has an access database using an ASP page. I have the user name and password needed to connect to the shared location but I am not sure how to set up the connection string in order to get this done. The access database I would like to connect to does not need a username or password, only the shared location does.
View 1 Replies
May 3, 2010
I am wondering how to encrypt the below information in the "web.config" file of the "Account" folder (where we have the secured pages):
[Code]....
My issue here is that even after I compiled my application (using "aspnet_compiler -v /reports c:
eports"), the information inside the web.config file of the Account folder still not encrypted, and I want to publish my site to the customer server. So, since this server is a customer server, then they can access this "web.config" file and change our web-application security behaviour (correct me if I am wrong). Basically, I don't want the customer to even have access to our secured pages when they access our web-application using the web browser. How to solve this issue?
View 2 Replies
Mar 9, 2010
Is there any tools available to encrypt and decrypt Asp.net Web configuration sections like connection string ,etc.?
Can i get any add-on for this?If i use Enterprise Library i can do so,but without that is there any simple utility available?
View 1 Replies
Mar 14, 2011
I have created an x590 certificate that is in the file :
"C:UsersmartinAppDataRoamingMicrosoftSystemCertificatesMyCertificates"
I am trying to acces the public key to encrypt some plain text.
The system is throwing an "System.ArgumentOutOfRangeException" at the line
Dim certificate As X509Certificate2 = certificateCollection(0)
Can anyone tell me where I am going wrong or tell me another way to access the public key
.................................................
This is the complete code:
Imports System.Security
Imports System.Security.Cryptography.X509Certificates
Imports System.Security.Cryptography.X509Certificates.X509Certificate2
Imports System.Security.Cryptography.Pkcs
Partial Class encryptwithcertificare
Inherits System.Web.UI.Page
Protected Sub Button1_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles Button1.Click
Dim encoding As UTF8Encoding = New UTF8Encoding
Dim cleartext As String = Textbox1.Text
Dim myStore As X509Store = New X509Store()
myStore.Open(OpenFlags.ReadOnly)
Dim certificateCollection As X509Certificate2Collection = myStore.Certificates.Find(X509FindType.FindBySubjectName, "bobby", True)
Dim certificate As X509Certificate2 = certificateCollection(0)
Dim code() As Byte = EncryptwithCertificate(cleartext, certificate)
Label1.Text = Convert.ToBase64String(code)
End Sub
Shared Function EncryptwithCertificate(ByVal cleartext As Byte, ByVal certificate As X509Certificate2) As Byte()
Dim encoding As UTF8Encoding = New UTF8Encoding
Dim cleartextsbyte() As Byte = encoding.GetBytes(cleartext)
Dim contentinfo As ContentInfo = New ContentInfo(cleartextsbyte)
Dim envelopedCms As EnvelopedCms = New EnvelopedCms(contentinfo)
Dim recipient As CmsRecipient = New CmsRecipient(certificate)
envelopedCms.Encrypt(recipient)
Return envelopedCms.Encode()
End Function
End Class
View 3 Replies
Nov 1, 2010
I want the login password to not be sent in plaintext (due to the risk of hijacking). I know that this can be achieved in principle using MD5 or the like, but is there a common implementation for use with Asp.Net? Of course, it's crucial that the resulting hash (?) isn't easy to decrypt. When I read various posts on this matter, some people say it's just to do a reverse on the encrypted string, so that in effect, this is totally useless.
View 6 Replies
Sep 8, 2010
I have been looking at ways of encrypting querystrings and I have found a few good examples.. but, I just want some clarification on what is most often referred to as the EncryptionKey and the characters that are in that key....Is there basically an unlimited number of alphanumeric combinations that could be used in the following code as the encryption key, is there anything that someone should be CAREFUL about including in that key?
using System.Security.Cryptography;
private static string EncryptionKey = "!#$a54?3";
/// other examples: "r0b1nr0y"
///in a try-catch:
key = System.Text.Encoding.UTF8.GetBytes(EncryptionKey.Substring(0, 8));
DESCryptoServiceProvider des = new DESCryptoServiceProvider();
inputByteArray = Convert.FromBase64String(Input);
View 3 Replies
Nov 12, 2010
I have written a couple methods that encrypt and decrypt the appSettings section of my web.config file using the WebConfigurationManager. I just hooked up the methods to the page_load event to test that it works, which it does. Now I need to deploy to a web farm and need advice. What is the best way to make it so I can encrypt, but more importantly decrypt the web.config when I need to? I thought about putting a hidden page with "encrypt" and "decrypt" buttons, but that seems risky. What is the "accepted" method for rolling out something like this?
View 1 Replies
Sep 2, 2010
I have looked at nearly every single WCF Rest PUT/POST issues on SO here and have still been unable to determine why I am unable to PUT or POST to my web service but am able to call a test GetTime method via GET. This particular service exchanges custom credential information (username, password and some other information) for a token. This token information is encrypted and added to the header of subsequent requests to other web services so that username/passwords don't have to be passed around everywhere. All web service calls are still treated as stateless, but require this auth header information rather username/passwords to access secured service operations.
[Code]....
I have also checked in IIS 7 the handler mappings for *.svc and checked that 'all verbs' are enabled.
View 1 Replies
Mar 4, 2011
I have been killing myself over this for a couple weeks now and cannot find a viable solution. Here's my scenario:
I have a DTSX package that imports user data from an external database. It then creates user accounts and profiles in the local database. Users can also be created via a custom ASP.NET Membership Provider. The provider must be able to authenticate both types of users.
This was all fine and dandy during development because passwords were stored as clear text. However, now that we're ready for release the passwords format of the provider must be set to encrypted and so the users created via the DTSX must be created with an encrypted password. (I'd prefer the passwords were hashed but the client's requirements are that passwords be recoverable). The real problem seems to be creating an encrypted password within the DTSX that will be decryptable by the ASP.NET Membership Provider.
My original solution was to have the DTSX call a CLR stored procedure that had access to the same encryption logic as the provider. I got it working but our client wouldn't enable CLR integration. So that's out the window. Now I'm investigating alternatives. One alternative is to simply use the built-in encryption methods of T-SQL. But how do I share the keys used for the encryption/decryption?
My question is, is it possible to generate a password in T-SQL, say using EncryptByKey, that will also be decryptable by my provider? This means that the key in SQL must match the key in my machineKey configuration.
View 2 Replies
Sep 23, 2010
Is aspnet_regiis.exe secure? If i encrypt using aspnet_regiis.exe, will it automatically decrypt the string and wont give any error? Need an insight into this stuff.... Is Rsa the best option or wat? Wat's the best way to encrypt/decrypt programmatically?
View 10 Replies
