Security Guidance.

[rpk2006]

In my application, I have a MS Access MDB file which stores all the user data.

Presently, I am using SHA-256 to store passwords in the table, and further protecting the MDB file itself with
MD5 Hash, to check the integrity of the file.
This MD5 Hash value is checked each time the application starts.

(1) Please suggest some good techniques for securing the Database file.

(2) When my application starts, decrypted or encrypted password is stored in public variables, depending upon situation. To secure the data, I immediately change the
value of these variables to "", as soon as the job of these variable is over.
Is this the way the Hash or Encrypted values are destroyed from memory?

Rohit. There is always a new solution for the same problem.

Anonymous

 

[chiph]

Another thing to do is not name variables "password", "secretkey", etc. as anyone with access to the .exe is able to scan for these. They can then find the offsets within the program and dynamically patch the program to skip over the security checks.

Chip H.