Application Security

From: Nathan Bullock (nathan_kent_bullock_at_yahoo.ca)
Date: 08/26/03 

Date: 25 Aug 2003 15:43:22 -0700

Hi everyone,

I am trying to figure out how to create a secure application. Here is
the situation:

SQL Server database
.NET (C#) clients

There is a global SQL Server userid and password.
In the database we store an application specific user id and SHA-1
encoded password.

Currently this SQL Server password is just stored in the registry, it
is encrypted in some fashion. This allows the application to connect
to SQL then the application checks whether this user is actually
allowed to be using the application and what access they have within
the application.

Anyways here is the problem: if a user has access to the bytecode of
the application then they could always decompile it, determine how we
are encrypting the SQL Server password, and login to SQL Server giving
them full access to the information in the system. Due to this
security problem it doesn't really matter how strongly encrypted there
application password is. Who knows what the proper way to handle
security in this sort of application.

Hopefully this is explained okay.

Nathan

Relevant Pages

  • RE: LDAP: Access Frontend and SQL Server Backend
    ... Use the windows authentication mode in your SQL server (check the SQL Help ... > sql server password is the same as their novell login, ...
    (microsoft.public.access.security)
  • Re: Password on Server
    ... > Jacco Schalkwijk ... > SQL Server MVP ...
    (microsoft.public.sqlserver.programming)
  • Re: Password History in SQL Server
    ... Mike Epprecht, Microsoft SQL Server MVP ... >I know that there is a rule in SQL Server password naming that last n ...
    (microsoft.public.sqlserver.security)
  • Re: Password on Server
    ... SQL Server MVP ... "rikesh" wrote in message ...
    (microsoft.public.sqlserver.programming)
  • Re: SQL server question
    ... Microsoft is deprecating it even for new development, ... An Access project is an Access file that provides a direct, ... You can connect an Access project to a remote SQL Server ... a local SQL Server database, or a local installation of the SQL Server ...
    (comp.databases.ms-access)