Encrypted Connection String and Security....Quick Question

Hi,

Assume I have an asp.net/sql server 2000 web app in a shared hosting
environment. I then encrypt the connection string using
ProtectSection("DataProtectionConfigurationProvider") in the page load
of my default.aspx page.

Am I understanding the following concepts then correctly?

1. I upload the site to the shared hosting server.
2. The first time I run the app eg. www.whatever.com/default.aspx,
the ProtectSection method above is executed.
3. Now the conn string area of my web.config is encrypted, and
asp.net will decrypt as needed.

4. If someone were to hack the server and view the web.config --
whether via getting into the server or via ftp, they would see an
encrypted connection string.


Thanks very much!

.

Relevant Pages

  • Re: Use Dpapi with Shared Asp.Net Web Host?
    ... Since the only directory I have access to on the web host server is a given ... > DPAPI is only suitable for encrypting and decrypting stuff on the same ... >> I'd like to use an encrypted database connection string. ... The dpapi should enable me to encrypt the ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: Encryption of Connection String
    ... If the connection string is for the session state server, ... Use the ASP.NET Utility to Encrypt Credentials and Session ...
    (microsoft.public.sqlserver.security)
  • Win32 DPAPI - Drawbacks?
    ... I have an ASPX form that has a connection string in the ... I have been trying to figure out how to encrypt the ... of choice since it does not require you store the keys anywhere. ... If you plan to migrate to a new server, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Encrypting connection string in app.config
    ... Is string at client side or on server side? ... but is there a way to use that to encrypt the connection ...
    (microsoft.public.dotnet.security)
  • Re: A cryptography solution for a client/server winforms app
    ... good idea if you want to learn crypto. ... you control both the client and server, you don't even need to use a ... code the client to ignore certificate trust errors. ... encrypt the memory stream. ...
    (microsoft.public.dotnet.security)
Loading