Re: Creating a Login Form in VB6

From: DavidM (spam_at_spam.net)
Date: 11/27/04 

Date: Sat, 27 Nov 2004 11:34:36 -0600

Sounds like you need to add a textbox for the user to enter a "Server name
or TCP/IP address".

Regarding password being sent across Internet -- it is sent clear-text and
is weakly encrypted using XOR. In one of our applications at work last
year, someone forgot the "SA" password (Don't get me started about SA) and
the application had it hardcoded.

The easiest way for me to figure out what the password was is to sniff
network during a logon session. I then decrypted password and cha-ching. I
was in.

I'm not sure if you can use it, but you can try NT Authenication instead of
SQL. That will at least make it a bit more secure without a password going
over the wire.

"NEWS" <newsgroup@questinfo.com> wrote in message
news:41a8b1af$0$8164$cc9e4d1f@news.dial.pipex.com...
>I have a related question...
>
> I also have a login form which I take the ID and password input by the
> user
> and uses ADO code to validate it on an SQL server database across the
> internet.
>
> My VB code contains the IP address of the SQL server database, the
> database
> name, and the user ID and password to connect to the SQL server database.
> Only then do I look up what the user entered.
>
> What I am NOT happy about is that I have the SQL server ID AND password
> hardcoded in the VB program. This does not seem very secure. If anyone
> looks
> inside the VB program, they will see it????? Also the ID & password will
> be
> sent across the interenet everytime I do a connection to the database ??
>
> Any suggestions abot how to make this more secure please.
>
> thanks
>
> Garry
>
>
> "DavidM" <spam@spam.net> wrote in message
> news:O7HcUYn0EHA.3336@TK2MSFTNGP11.phx.gbl...
>> Hello --
>>
>> I have a Login form that I have written using VB6. Everything works, but
> I
>> do have a couple opportunities, if you will.
>>
>> Currently, I only have a Username and Password text box. When the user
>> presses the OK button, I pass the username/password textbox values to a
>> subroutine.
>>
>> The subroutine attempts to open an ADO connection using the supplied
> values.
>>
>> All this works, however, I need to also include the Server= and Database=
>> options along with the User ID= and Password= options.
>>
>> Therefore, I need to include a Server and Database dropdown on my login
>> form.
>>
>> Now, I could go very basic and just have a textbox and, if they know
> exactly
>> what they want, they can simply key it in and life will be good.
>> However,
>> I'm thinking ahead and would like to code it like most login forms
> where....
>>
>> 1) I can enter an IP address/Name in the text box, or browser for a
> server.
>>
>> 2) As soon as I enter a Servername/Username/Password, and before I hit
>> OK,
>> the "Database" listbox will populate with a list of databases to the
> server
>> the user has access to.
>>
>> Does anyone have any code they can share for doing this?
>>
>> I assume I'm going to have to use something else other than ADO... like
>> DMO.
>>
>> If I do use DMO, I assume my login method I'm using today will change.
> I'd
>> first use DMO to authenicate... and if that works, I'd then open a
> database
>> connection using ADO??
>>
>> Finally, what does this do for deploying my application. I'm currently
>> in
>> the process of using InnoSetup for my project. Do/can I include these
>> additional files or what?
>>
>> Any help would be appreciated.
>>
>>
>
>