Question

I am using the following code in c# to download a file from my website:

WebClient webClient = new WebClient();
webClient.Credentials = new System.Net.NetworkCredential("username", "password");
webClient.DownloadFile("http://example.com/file.txt", "file.txt");

The file is only downloaded when certain criteria are met, so I don’t want the users to be able to access the files on my site

My corcern is that if a curios users decompiles the code, he will find the password and be able to access all the files on my site.

I’ve read that a secure way to save the password is to store its hash, but I don’t know how to implement it in this example.

What options do I have to keep my password secure and make it impossible for a user to find it?

Answer 1

You simply don’t. Users give you passwords to do stuff, not the other way around.

If the user has to prove “certain conditions”, then pass proof of those certain conditions to the server, and let it decide whether to allow the download or not.