Re: Places to store a password

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

If you need to retrieve the actual value of the password, you could put it
in Web.config - but make sure it's properly encrypted. Better still, put it
in a database (encrypted). You could also store it in the filesystem in a
folder only readable by your application. And finally, something we have
actually done, is to store the encrypted password in a database, but
retrieve it via a remote object: this allows you to have your application,
your remote object and your database all on different machines, which adds
some extra layers of security. Security is all about layers.

However, if you just want to compare the password with one that's been
entered, for authentication purposes, then store a hash - again, preferably
in a database. You never retrieve the password itself, but compare the hash
of the entry against the hash you've saved.


Peter


"eggie5" <eggie5@xxxxxxxxx> wrote in message
news:1173742628.827330.58150@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
I'm looking for the best place to store a general password I use on
my website. Short of hard coding it into one of my aspx.cs files, I'm
trying to find a good place to store it. The only place I can think of
is the web.config file. Can somebody give me some pointers on elegent
ways to do this with asp.net?



.

Relevant Pages

  • Re: DOCX FILE CORRUPTED WHEN RETRIEVED FROM SQL2005
    ... I am facing the same problem and would appreciate your reply on the same as it has become a show stopper for me now. ... My Code is given below to retrieve the docx content from SQL 2005 whose data type is image. ... Here is the code where i insert the file into database. ... when I store these files to the server, using the code below and similar ...
    (microsoft.public.office.developer.vba)
  • Re: Best practice for password hashing
    ... unless there is a database compromise. ... The most common scheme is never to store passwords, but to instead store a cryptographic hash of the password. ... That way, if the base machine is compromised, they can't guess very rapidly unless they can compromise both machines. ...
    (sci.crypt)
  • Re: Perl function for password encryption and decryption
    ... store them to a database. ... password and compare it to the database. ... hash what they entered and compare it to the stored hash. ...
    (perl.beginners)
  • Re: How to insert a parenthesis into a field
    ... scrambling the password is adequate to keep people from knowing that they ... scrambled password is altered, the hash won't work. ... Probably slows the database down a bit, ... store the string. ...
    (microsoft.public.sqlserver.server)
  • Re: LAMP - Program Design with Perl
    ... Does that mean that the second column of the database stores all ... > into a hash and then go through all possible parameters ... strings with the info needed to access the data base. ... could store the info needed to display the data. ...
    (comp.lang.perl.misc)