Re: Make Security to Directory

From: Dominick Baier [DevelopMentor] (dbaier_at_pleasepleasenospamdevelop.com)
Date: 05/19/05 

Date: Thu, 19 May 2005 03:54:26 -0700

Hello husamal_ahmadi@yahoo.com,

you will never be able to "hide" something from an admin.

You can indeed prevent normal users from modifying/reading the data :

run as admin, create the files, ACL them. But then your application (running
as a normal user) won't be able to read the files also.

If you want to store "secrets" on a client machine - encrypt them. System.Security.Cryptography
is your friend.

Be aware that you need a key for encryption - this has to be stored somehow
- e.g. hardcoded in your app code - this is also not a perfect solution,
but significantly (depending on your clients) raises the bar.

Encryption is not integrity protection - you could use keyed hashes for that,
e.g. This could get complicated quickly.

So if you only want to store something on the client and your app needs only
read access:

run an installer as admin
encrypt the files
put ACLs in place that prevent modification

a sample app for encrypting files can be found here:
http://www.leastprivilege.com/PermaLink.aspx?guid=f73ca1e0-bcfa-4563-862f-eb06ab317075

HTH

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

> Hi Nicole :
>
> My goal behind that I want to prevent reading and modifying all the
> files by all users.
>
> regard's
>
> Husam
>

Relevant Pages

  • RE: local admin account password
    ... Any encryption can be cracked, it's just a question of time. ... Say you have more then 1000 systems, how do you handle the local admin ... Only use domain accounts so delete the local ones. ... 5)My main idea/plan is to store all the passwords on a central SQL server. ...
    (Focus-Microsoft)
  • Re: Protect Confidential Data from Myself
    ... financial information and trade secrets. ... Encryption will only keep you out if you are irresponsible. ... By irresponsible I mean not having an admin person able to recover the data. ... You restore from an offsite backup BUT all your data is encrypted with keys ...
    (microsoft.public.windows.server.active_directory)
  • Re: Encrypting connection strings in .Net
    ... I am not talking about a threat from an admin per se (although, ... prevent a hacker from being able to see this secret. ... Anyway, if you encrypt the secret, but store the encryption key in plain ...
    (microsoft.public.dotnet.security)
  • Re: Encrypted File Systems
    ... Supposedly one of the big issues with EFS in 2K was that the Default ... So my impression was that if you had a competent admin who made his DRA ... anything to the contrary--that the encryption itself isn't all that bad. ... > I understand that the Windows EFS implementation had some issues on win2k, ...
    (Security-Basics)
  • Re: locked out of XP, need file access
    ... this is going to take a long while to crack/break the encryption. ... >> ALL very valid questions. ... >> What I'd like to know is why someone is using the Admin account on a ... If the reader of this message is not the intended recipient, ...
    (Security-Basics)
Loading