Obfuscate connection-string c#
I work with C# WPF ClickOnce-Installer. My target is to hide the connection-strings to the user.
I found a possibility to encrypt the connection-strings in app.config while starting the application(ref). Problimatically it doesn't encrypt the connection-parameters at the installer-directory where the application gets updates from. This file is called appname.exe.config.deploy and contains the password in plaintext. So if the user knows where the updates come from, he can just read the connection-strings...
So my idea was just to use an obufscation-method to obfuscate only the connection-strings before deployment. Are there any good methods for this way so the user cant easily refactor the connection-string?
c# encryption connection-string clickonce obfuscation
asked Nov 26 '18 at 10:43
chchchchchchchchchchchchchchchch
12
|
show 3 more comments
I work with C# WPF ClickOnce-Installer. My target is to hide the connection-strings to the user.
I found a possibility to encrypt the connection-strings in app.config while starting the application(ref). Problimatically it doesn't encrypt the connection-parameters at the installer-directory where the application gets updates from. This file is called appname.exe.config.deploy and contains the password in plaintext. So if the user knows where the updates come from, he can just read the connection-strings...
So my idea was just to use an obufscation-method to obfuscate only the connection-strings before deployment. Are there any good methods for this way so the user cant easily refactor the connection-string?
c# encryption connection-string clickonce obfuscation
asked Nov 26 '18 at 10:43
chchchchchchchchchchchchchchchch
12
For which database? If you use Windows Authentication with a database that supports it, there's no need to specify an account at all
– Panagiotis Kanavos
Nov 26 '18 at 10:47
3
In short, if it is on user machine, then user has access to everything. There is absolutely no way to "hide" connection string from user. Instead, you need to provide access to database on per-user basis or make proper authentication on server side.
– Yeldar Kurmangaliyev
Nov 26 '18 at 10:47
2
Possible duplicate of .Net Encryption
– dlatikay
Nov 26 '18 at 10:48
IMHO This is a XY problem, you should focus on a connection string without confidential data (AKA use windows authentication) instead of encrypting the connection string (a skilled user with adecuate access to the machine could decrypt it because the user need to have access to the key/certificate used to encrypt it)
– bradbury9
Nov 26 '18 at 11:34
I dont want to let the user know what s the name of the database, because i dont want him to logon on our database and UPDATE or SELECT the various tables. He should not be able to see the data or manipulate it so i thought the best way (after encrypting the conn-strings) is to obfuscate the connection-strings... Aren t there good methods for obfuscation the connection strings? I dont know what to do else!
– chchchchchchchch
Nov 26 '18 at 13:09
|
show 3 more comments
I work with C# WPF ClickOnce-Installer. My target is to hide the connection-strings to the user.
I found a possibility to encrypt the connection-strings in app.config while starting the application(ref). Problimatically it doesn't encrypt the connection-parameters at the installer-directory where the application gets updates from. This file is called appname.exe.config.deploy and contains the password in plaintext. So if the user knows where the updates come from, he can just read the connection-strings...
So my idea was just to use an obufscation-method to obfuscate only the connection-strings before deployment. Are there any good methods for this way so the user cant easily refactor the connection-string?
c# encryption connection-string clickonce obfuscation
asked Nov 26 '18 at 10:43
chchchchchchchchchchchchchchchch
12
I work with C# WPF ClickOnce-Installer. My target is to hide the connection-strings to the user.
I found a possibility to encrypt the connection-strings in app.config while starting the application(ref). Problimatically it doesn't encrypt the connection-parameters at the installer-directory where the application gets updates from. This file is called appname.exe.config.deploy and contains the password in plaintext. So if the user knows where the updates come from, he can just read the connection-strings...
So my idea was just to use an obufscation-method to obfuscate only the connection-strings before deployment. Are there any good methods for this way so the user cant easily refactor the connection-string?
c# encryption connection-string clickonce obfuscation
c# encryption connection-string clickonce obfuscation
asked Nov 26 '18 at 10:43
chchchchchchchchchchchchchchchch
12
asked Nov 26 '18 at 10:43
chchchchchchchchchchchchchchchch
12
asked Nov 26 '18 at 10:43
chchchchchchchchchchchchchchchch
12
asked Nov 26 '18 at 10:43
chchchchchchchchchchchchchchchch
12
asked Nov 26 '18 at 10:43
chchchchchchchchchchchchchchchch
12
12
For which database? If you use Windows Authentication with a database that supports it, there's no need to specify an account at all
– Panagiotis Kanavos
Nov 26 '18 at 10:47
3
In short, if it is on user machine, then user has access to everything. There is absolutely no way to "hide" connection string from user. Instead, you need to provide access to database on per-user basis or make proper authentication on server side.
– Yeldar Kurmangaliyev
Nov 26 '18 at 10:47
2
Possible duplicate of .Net Encryption
– dlatikay
Nov 26 '18 at 10:48
IMHO This is a XY problem, you should focus on a connection string without confidential data (AKA use windows authentication) instead of encrypting the connection string (a skilled user with adecuate access to the machine could decrypt it because the user need to have access to the key/certificate used to encrypt it)
– bradbury9
Nov 26 '18 at 11:34
I dont want to let the user know what s the name of the database, because i dont want him to logon on our database and UPDATE or SELECT the various tables. He should not be able to see the data or manipulate it so i thought the best way (after encrypting the conn-strings) is to obfuscate the connection-strings... Aren t there good methods for obfuscation the connection strings? I dont know what to do else!
– chchchchchchchch
Nov 26 '18 at 13:09
|
show 3 more comments
For which database? If you use Windows Authentication with a database that supports it, there's no need to specify an account at all
– Panagiotis Kanavos
Nov 26 '18 at 10:47
3
In short, if it is on user machine, then user has access to everything. There is absolutely no way to "hide" connection string from user. Instead, you need to provide access to database on per-user basis or make proper authentication on server side.
– Yeldar Kurmangaliyev
Nov 26 '18 at 10:47
2
Possible duplicate of .Net Encryption
– dlatikay
Nov 26 '18 at 10:48
IMHO This is a XY problem, you should focus on a connection string without confidential data (AKA use windows authentication) instead of encrypting the connection string (a skilled user with adecuate access to the machine could decrypt it because the user need to have access to the key/certificate used to encrypt it)
– bradbury9
Nov 26 '18 at 11:34
I dont want to let the user know what s the name of the database, because i dont want him to logon on our database and UPDATE or SELECT the various tables. He should not be able to see the data or manipulate it so i thought the best way (after encrypting the conn-strings) is to obfuscate the connection-strings... Aren t there good methods for obfuscation the connection strings? I dont know what to do else!
– chchchchchchchch
Nov 26 '18 at 13:09
For which database? If you use Windows Authentication with a database that supports it, there's no need to specify an account at all
– Panagiotis Kanavos
Nov 26 '18 at 10:47
For which database? If you use Windows Authentication with a database that supports it, there's no need to specify an account at all
– Panagiotis Kanavos
Nov 26 '18 at 10:47
3
3
In short, if it is on user machine, then user has access to everything. There is absolutely no way to "hide" connection string from user. Instead, you need to provide access to database on per-user basis or make proper authentication on server side.
– Yeldar Kurmangaliyev
Nov 26 '18 at 10:47
In short, if it is on user machine, then user has access to everything. There is absolutely no way to "hide" connection string from user. Instead, you need to provide access to database on per-user basis or make proper authentication on server side.
– Yeldar Kurmangaliyev
Nov 26 '18 at 10:47
2
2
Possible duplicate of .Net Encryption
– dlatikay
Nov 26 '18 at 10:48
Possible duplicate of .Net Encryption
– dlatikay
Nov 26 '18 at 10:48
IMHO This is a XY problem, you should focus on a connection string without confidential data (AKA use windows authentication) instead of encrypting the connection string (a skilled user with adecuate access to the machine could decrypt it because the user need to have access to the key/certificate used to encrypt it)
– bradbury9
Nov 26 '18 at 11:34
IMHO This is a XY problem, you should focus on a connection string without confidential data (AKA use windows authentication) instead of encrypting the connection string (a skilled user with adecuate access to the machine could decrypt it because the user need to have access to the key/certificate used to encrypt it)
– bradbury9
Nov 26 '18 at 11:34
I dont want to let the user know what s the name of the database, because i dont want him to logon on our database and UPDATE or SELECT the various tables. He should not be able to see the data or manipulate it so i thought the best way (after encrypting the conn-strings) is to obfuscate the connection-strings... Aren t there good methods for obfuscation the connection strings? I dont know what to do else!
– chchchchchchchch
Nov 26 '18 at 13:09
I dont want to let the user know what s the name of the database, because i dont want him to logon on our database and UPDATE or SELECT the various tables. He should not be able to see the data or manipulate it so i thought the best way (after encrypting the conn-strings) is to obfuscate the connection-strings... Aren t there good methods for obfuscation the connection strings? I dont know what to do else!
– chchchchchchchch
Nov 26 '18 at 13:09
|
show 3 more comments
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53479386%2fobfuscate-connection-string-c-sharp%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53479386%2fobfuscate-connection-string-c-sharp%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
For which database? If you use Windows Authentication with a database that supports it, there's no need to specify an account at all
– Panagiotis Kanavos
Nov 26 '18 at 10:47
3
In short, if it is on user machine, then user has access to everything. There is absolutely no way to "hide" connection string from user. Instead, you need to provide access to database on per-user basis or make proper authentication on server side.
– Yeldar Kurmangaliyev
Nov 26 '18 at 10:47
2
Possible duplicate of .Net Encryption
– dlatikay
Nov 26 '18 at 10:48
IMHO This is a XY problem, you should focus on a connection string without confidential data (AKA use windows authentication) instead of encrypting the connection string (a skilled user with adecuate access to the machine could decrypt it because the user need to have access to the key/certificate used to encrypt it)
– bradbury9
Nov 26 '18 at 11:34
I dont want to let the user know what s the name of the database, because i dont want him to logon on our database and UPDATE or SELECT the various tables. He should not be able to see the data or manipulate it so i thought the best way (after encrypting the conn-strings) is to obfuscate the connection-strings... Aren t there good methods for obfuscation the connection strings? I dont know what to do else!
– chchchchchchchch
Nov 26 '18 at 13:09