Question

I am using MySQL Connector with my C# project to directly connect to a database to store statistical information. My question is if I release this project and someone has the willingness to try to access my database, can they grab the connection string to my database from within the software? I am using the SQL Connector so I can save data in real time and not generate massive HTTP requests, for those wondering why don’t I just send the data in an HTTP req.

Answer 1

Yes. This is why they encourage the N-Tier approach. Your application should be going through a .NET webservice, WCF Service, RIA Services, etc. Your service would then in access the database and edit, insert, select the data from the database. Of course your service will be responsible for some type of authentication process and determine which roles and functionality will be available. For instance some logins may only have read access to the Orders table. Some may have full blown admin rights of read/write/edit. Some logins may have only read access to the customers table or maybe even only to their own customer record, etc.

You never want to expose your database login credentials to anything outside of your own network. Even if you are using Obfustication or encryption if your app is connecting directly to the database at some point it has to send those credientials and this gives the hacker an opportunity to intercept or capture those values.

By using an N-Tier architecture the user has know a login/username that is not their own in order to gain more privelages. Even through SSL who cares if they crack how to gain access to the webservice using their own username/password if it doens’t give them any more access than it does through your program it is not a big deal. They have to learn/steal someone else’s password perhaps the Admins username/password which you can easily fix by changing once a month.

You mentioned sending the connection string in an HTTP request. As soon as someone hacks that you can change your database username/password all you want but they already know how to hack that. In other words never put your sa/DBOwner username passoword in your app. In order for it to be secure you need to be going through some type of web service which requires a username and password and that is responsible for determining the user’s priveleges. The service should be on your own network so they would have to hack the web server or IIS in order to actually break into your database.

Some people go so far as to encrypt the username/password of the database in the config file of the webservice but it’s not really necessary unless you are working in a large corporation where many admins have access to the config file but only a handfull of them should be able to access the database. In my opinion plain text in the config file is fine unless the data is super sensitive and you have multiple people that are able to access the config file that shouldn’t know the username/password. The whole point to this is that only people in your corporation have access to the config file…the average joe running the application that isn’t in your corporation should never have any way of getting this unless they physically hack into your IIS server…in which case you got bigger problems.