Question

Let’s say i have a datagrid with the following columns;

DataTable dataTable66 = new DataTable();

        DataColumn colDescription = new DataColumn("userID");
        dataTable66.Columns.Add(colDescription);
        DataColumn colActive = new DataColumn("Username");
        dataTable66.Columns.Add(colActive);
        DataColumn colPass = new DataColumn("Password");
        dataTable66.Columns.Add(colPass);
        DataColumn colRole = new DataColumn("Role");
        dataTable66.Columns.Add(colRole);

I create a datagrid, and for ease of use i choose to have a column for password and userID, but know that because i want to hide these details from the end-user, and use them just for reference in my program (such as updating to a database), i choose to hide these columns by via;

   datagrid.Columns[0].Visible = false;
   datagrid.Columns[2].Visible = false;

Does this create any security risks as far as the developer / database is concerned? Obviously the password itself is just the hash of the password using whatever means i choose to encrypt it, but could a user find a way of getting these details that are now stored in the DataTable / DataGrid?

Answer 1

If a user attached a tool like WinDbg your app, or if they dumped the process, then it would be easy to browse through the DataTable (or any other data structure). Does that represent a risk for your app? I guess you’re in the best position to evaluate that. What could a user do with that information?