Places to store a password

[eggie5]

I'm looking for the best place to store a general password I use on
my website. Short of hard coding it into one of my aspx.cs files, I'm
trying to find a good place to store it. The only place I can think of
is the web.config file. Can somebody give me some pointers on elegent
ways to do this with asp.net?

 

[Keith Patrick]

Try looking into the Data Protection API that was introduced in Win2k. It's
exposed in .Net via the System.Security.Cryptography.ProtectedData class.
The .config file isn't a great place, as it's only protected from users by
IIS blocking access (and I've seen a web site expose it when someone
inadvertantly deregistered ASP.Net)

 

[Peter Bradley]

If you need to retrieve the actual value of the password, you could put it
in Web.config - but make sure it's properly encrypted. Better still, put it
in a database (encrypted). You could also store it in the filesystem in a
folder only readable by your application. And finally, something we have
actually done, is to store the encrypted password in a database, but
retrieve it via a remote object: this allows you to have your application,
your remote object and your database all on different machines, which adds
some extra layers of security. Security is all about layers.

However, if you just want to compare the password with one that's been
entered, for authentication purposes, then store a hash - again, preferably
in a database. You never retrieve the password itself, but compare the hash
of the entry against the hash you've saved.


Peter

 

[Paul]

I'm looking for the best place to store a general password I use on
my website. Short of hard coding it into one of my aspx.cs files, I'm
trying to find a good place to store it. The only place I can think of
is the web.config file. Can somebody give me some pointers on elegent
ways to do this with asp.net?

If you really only need a single password, I would store a hash of it
in the Webconfig.

This should be suitably secure as long as you 'salt' the password in
your code.

Then when you test the PWD in your code, simply hash and then test
against your webconfig key.

If you need code, just reply, I will try and post some.