Secure user name and Password in Web Config

[maa]

I want to be able to securely encrypt a user name and password for a web app.
The user name/password is to be used in for authorization to a web service
not a db. For security reasons the company wants to encrypt what is in the
web config file and be able to move the web app to different machines without
having to re-encrypt it.
Is this possible?
Is there a security hole in this procedure that might be better handled by a
call to a web service app holding the user name and password?
Thanks,
Marc

 

[Dominick Baier]

have a look at the protected configuration feature in .NET (and the aspnet_regiis
tool)