Passing username/password in a secure way on a Remoting call

From: Elp (rockfamily_at_REMOVEME.hotmail.com)
Date: 10/16/03 

Date: Thu, 16 Oct 2003 15:14:46 +0100

Hi,

I'm developping a distributed application where a client app calls some
methods on a remote .NET remoting object. For some reasons, i have to host
that object within a Windows service (not IIS) using a TCP channel and i
can therefore not use the authentification features of IIS (this was anyway
not suitable for our needs).

The remote object has to ensure that the client is allowed to call its
methods: to achieve that, i pass a username and password as parameters for
each remote function call. Right now, this info is passed in clear text and
i guess that i could be possible for an attacker to "read" those
credentiuals direclty on the wire. What could i do to make that more secure?
I've read an article which explains how to use symetric key
encryption/decryption but if i use that to encrypt the password, i need to
hardcode in the client and server apps the values used to genereate the key
and, as .NET code can be easily reversed engineered, this is not really what
i would call security. I have therefore a few questions for those more
knowledgeable than me :-) (it's the first time that i have to deal with some
security problem):

- is encryption using symetric key the way to go in my situation?
- if not, do you have any other idea?
- how can i protect the values used to generate a symetric key as hardcoding
them in code is not secured at all? There's maybe some way to store those
values somewhere else on the computer.

Thanks a lot for your help.

Relevant Pages

  • Re: RWW Disconnecting
    ... I understand that remote client encounts following error message when RWW ... I strongly suggest that we rerun the Configure E-mail and Internet ... 825763 How to configure Internet access in Windows Small Business Server ...
    (microsoft.public.windows.server.sbs)
  • Re: Great SWT Program
    ... graphics; one-button mice...all while the machines have tended to be ... the internet are good enough that you can run a modern-as-of-2007 GUI ... * Remote machine has graphical app running that tells the Windows ... network to the client to display a button labeled "foo" at those ...
    (comp.lang.java.programmer)
  • Re: Redirect problems to remote client
    ... sent you a copy of the results file from the client. ... > remote client and redirecting the My Documents folder. ... > - Internet Explorer Maitenance policy processing ... Microsoft is providing this information as a convenience to you. ...
    (microsoft.public.windows.server.sbs)
  • RE: Remote connectivity problems
    ... do you mean you have added a remote client to SBS ... If you have hardware VPN tunnel setup using Linksys or others, ... In this scenario you have to configure the SBS Server computer to enable ...
    (microsoft.public.windows.server.sbs)
  • Re: Mapped Drives over VPN
    ... When the client tries to access a share on the remote machine, ... Microsoft CSS Online Newsgroup Support ... | They have generally two mapped drives. ...
    (microsoft.public.windows.server.sbs)
Loading