I want to create an application that connects to a central remote database, and this application is intended to be given to several users to use on their computer, in a local network. the main challenge for us is to hide connection string from the users, in order to prevent potentially malicious uses.
thus far i’ve found that i must use RsaProtectedConfigurationProvider class, described at there to encrypt app.config, and to decrypt it. but i can’t figure out how can i give the needed RSA keys to clients? and how all this prevents crackers from finding the key and using it to decrypt app.config?
thanx everyone 😉
You can’t let users have client applications that connect directly to the database, and expect to be able to hide the connection string. This can’t be done.
If the connection string must stay secret, store it on the server and let client applications connect to a web service, instead of directly to the database.