Re: Encryption of Connection String

From: paul reed (prreed@jacksonreed.com)
Date: 01/02/03 

From: "paul reed" <prreed@jacksonreed.com>
Date: Thu, 2 Jan 2003 06:16:52 -0800

Jasper,

I don't think ANY encryption is applied to the string by default.

Regards,

Paul
"Joubert Nel" <> wrote in message
news:#4NqB7YsCHA.2448@TK2MSFTNGP09...
> Hi Jasper,
>
> Do you know what level of encryption IS applied to the connection string?
I
> cannot find any documentation on this.
>
> Regards,
>
> Joubert.
>
>
> "Jasper Smith" <jasper_smith9@hotmail.com> wrote in message
> news:e9i2Po$rCHA.1656@TK2MSFTNGP09...
> > Just to add to that, when the Web Server makes the connection
> > to the SQL Server via SQL authentication the password is only
> > encrypted with very weak encryption that is extremely simple to
> > decrypt. Thus you might have made all this effort to encrypt the
> > conn string in your app but when it actually gets sent across the
> > wire it is tantamount to cleartext (it's not clear text but if you know
> > how it's easy to pick out the data and decrypt it). Thus Windows
> > Authentication is always the preferred option unless you are using
> > SSL or IPSEC to secure the connection between the Web Server
> > and SQL Server.
> >
> > --
> > HTH
> >
> > Jasper Smith (SQL Server MVP)
> >
> > I support PASS - the definitive, global
> > community for SQL Server professionals -
> > http://www.sqlpass.org
> >
> > "Gang Guo [MSFT]" <gangguo@online.microsoft.com> wrote in message
> > news:ta$M2s8rCHA.3108@cpmsftngxa06...
> > > If the connection string is for the session state server, please check
> the
> > > following article.
> > >
> > > Q329290 HOW TO: Use the ASP.NET Utility to Encrypt Credentials and
> Session
> > > State
> > > http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q329290
> > >
> > > If it is for your application, my advice is to use Windows
> authentication
> > > to connect to your SQL server, thus you will not need store the user
> name
> > > and password in any form.
> > >
> > > If you need use the standard authentication (that means the UID and
PWD
> > are
> > > needed for the connection string), as long as you keep your web
server
> > > safe, it doesn't make big difference how you encrypt your connection
> > > string. If you just don't want to store the connection string as clear
> > text
> > > in the config file, you can use some class under
> > > System.Security.Cryptography to encrypt/decrypt it, and store the key
in
> > > your code/or some registry.
> > >
> > > Remember one thing, no matter how your application encryption/store
the
> > > connection string, you must decrypt and restore the UID/PWD to clear
> text
> > > before you make the connection. If your web server is not physical
> > secured,
> > > someone who are really want to get your connection string just need
> crack
> > > the uid/pwd at that time and that will defeat all your effort for
> > > protection.
> > >
> > >
> > > Regards,
> > > Gang Guo
> > > This posting is provided "AS IS" with no warranties, and confers no
> > rights.
> > > Got .Net? http://www.gotdotnet.com
> > >
> >
> >
>
>

Relevant Pages

  • Re: Help Encrypting Connection String
    ... I have simply 'overridden' the LocalSqlServer connection string to point to my SQL Server DB. ... to encrypt the section and places it into web.config - the config file then refers to the reg key. ... I don't like to hardcode anything, in general, but I'd rather do that with an encryption key than the underlying data itself. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Connection string stored in registry
    ... The thing is, i dont wanna now whats best, like encryption, or a global ... has the ability to read a connection string directly from a registry ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: SQL Server 2005 connection from VB.NET 2003
    ... This worked with SQL Server 2000, but I'm wondering if this is the problem with 2005. ... Public Function GetRemoteSqlDBConnectStr(ByVal strExtServerName As String, ByVal strExtDbName As String) As String ... I changed the connection string on the PC application to point to the new instance of SQL server, and to my surprise it worked and connected to 2005 without any changes in code. ... Do I have to install anything else on the PC where 2005 is installed to allow access from CE devices, or can I change the connection string / use ODBC instead of SqlConnection? ...
    (microsoft.public.dotnet.framework.compactframework)
  • Re: Read info from a file
    ... :>> string I wanted to read from the file was the Initial Catalog and the ... :>>> Are you using ADO to connect to the db? ... :>>>> I have a project that is going to connect to a SQL Server. ... :>>>> connection string so that it looks at the correct SQL Server and ...
    (microsoft.public.vb.syntax)
  • Re: Encrypt connection channel
    ... I assume that you are talking only about encryption during transmission, ... this question is not about how to store sensitive data in a database. ... > DMZ and SQL Server in secured zone? ... > 1 Encrypt the connection string that is used to make a connection, ...
    (microsoft.public.sqlserver.security)