Question

Here are my connections strings:

  <connectionStrings>
    <add name="ArticleDbContext" connectionString="Data Source=|DataDirectory|MyBlog.sdf" providerName="System.Data.SqlServerCe.4.0" />
    <add name="BlogDbContext" connectionString="Data Source=|DataDirectory|MyBlog.sdf" providerName="System.Data.SqlServerCe.4.0" />
    <add name="CompanyDbContext" connectionString="Data Source=|DataDirectory|MyBlog.sdf" providerName="System.Data.SqlServerCe.4.0" />
    <add name="UserProfileDbContext" connectionString="Data Source=|DataDirectory|MyBlog.sdf" providerName="System.Data.SqlServerCe.4.0" />
    <add name="ApplicationServices" connectionString="Data Source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb1.mdf;User Instance=true" providerName="System.Data.SqlClient" />
  </connectionStrings>

I was reading this http://msdn.microsoft.com/en-us/library/ms181873(v=vs.90).aspx on Considerations for Implementing Applications.

I believe I should put passwords on these and then encrypt. Is that correct, and how do I do it after the fact? Is there any concern with putting passwords in my web.config file? I read something about decompilers being able to read your passwords… Is this a real threat? What can I do to secure this app?

Answer 1

You should always encrypt sensitive information stored in a config file. You can do it programmaticaly or via aspnet_regiis (see docs for more details).

Why?

Because people can download a web.config file in plain text through different vulnerabilities and then they can read all the connection strings, user names, passwords etc.

Possible attack list:

• MS10-070 with a video
• Any other user on the machine can read web.config. This adds a huge list off all disclosed and non-disclosed attacks on the OS itself.
• Attack on the IIS FTP and subsequent web.config transmission, for example this one