Question

My .NET WinForms application connects to ftp server and downloads a file. To do that a password for the connection is required. The password should be stored in a configuration file, but it should be encrypted. The only solutions to do that that I’ve found include either securing whole config section (which is no use for me as in the appSettings section where the password is there is other data that needs to be changed manually) or using DPAPI (and it doesn’t work too because passwords encrypted on my computer cannot be decrypted on the others and this is necessary). Are there any other techniques?

Answer 1

You could encrypt and decrypt manually using a symmetric cipher inside your application (i.e. AES ), and have the encrypted password stored in the config file.

The problem of course with this is that you’ll have to store the symmetric key that encrypts and decrypts the password inside your application, so anyone with any knowledge of crypto and .net would be able to reflect and reverse engineer your binary fairly easily – and get hold of the key and therefore the FTP password.

You could obfuscate your binary to make this more difficult.

Of course, the FTP username and passwords are sent in clear-text anyway (unless you are using ftps:), so anyone ‘listening’ to your app will figure out the username and password fairly quickly.

I guess it comes down to how secure you want this username and password in your application? This solution prevents those with prying eyes from getting hold of it, but not those that are determined.