DataSource password storage options

[djfrear]

I am currently working on an enterprise app which need's to store a database password. This data will be stored in a configuration file of sorts.

The obvious problem is that I cannot store the password as a plain string. I have been through several types of encryption and keep coming up with the same problem - I would need to store a key in order to encrypt the data, and where would I store the key?

If the key is in the source code it's reasonably easy to reverse engineer the code and find the key. If its in a config file it defeats the object.

Now this must be a very common problem and im sure there's something extremely simple I'm just missing. Can anyone point me in the right direction?

Thanks in advance

 

[jmeckley]

I would go with encrypting the connection string node in the web/app config file. This feature was added to 2.0 for this exact purpose.

Jason Meckley
Programmer
Specialty Bakers, Inc.