Question

just want to ask what would be the best way to hide sensitive data (ftp accounts, database connectionstring, etc) in .Net desktop applications.. any suggestions please.. 🙂

i was aware of putting data in the application and got in mind that what if the application will be deobfuscated or decompiled the hidden data will be expose.

i tried using Application Settings

Properties.Settings.Default.MyConnectionString = theConString;

but still the data can be seend when decompiled.

any suggestions please.

Answer 1

You can encrypt all or part of the app.config file. This is particularly common for protecting database connection strings.

Here is a detailed article about how to to this. In a nutshell, here is the code from there for encrypting the connection string section in app.config:

static void ToggleConfigEncryption(string exeConfigName)
{
    // Takes the executable file name without the
    // .config extension.
    try
    {
        // Open the configuration file and retrieve 
        // the connectionStrings section.
        Configuration config = ConfigurationManager.
            OpenExeConfiguration(exeConfigName);

        ConnectionStringsSection section =
            config.GetSection("connectionStrings")
            as ConnectionStringsSection;

        if (section.SectionInformation.IsProtected)
        {
            // Remove encryption.
            section.SectionInformation.UnprotectSection();
        }
        else
        {
            // Encrypt the section.
            section.SectionInformation.ProtectSection(
                "DataProtectionConfigurationProvider");
        }
        // Save the current configuration.
        config.Save();

        Console.WriteLine("Protected={0}",
            section.SectionInformation.IsProtected);
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }
}