Re: The SA Mess

From: Russell Stevens (rustyprogrammer_at_online.nospam)
Date: 03/18/05 

Date: Thu, 17 Mar 2005 20:01:07 -0500

Mike,

<<If the DB password is hard coded in your application, any 1/2 geek with 3
minutes of access to the .EXE will figure out the password.>>

The password and user id is encrypted, stored in a config file. The windows
app reads it then must decrypt it to create a connection string. A hacker
with access to the machine could get it with a debugger but then, he has the
machine anyway <g>. The app is obfuscated. The hacker can't get it going
down the wire, he can't get it out of the config file, and it would be
pretty difficult to get out of machine memory - he would have to find where
it is decrypted - doable but I think it will take more than 3 minutes....
But that also applies to any password whether it is the one you are
connecting to a firewall with, connecting to a web server with, etc. (I read
today that Microsoft is getting away from passwords in the next OS).

<< look at a middle tier, and use something like HTTPS and web services to
supply functionality to your application.>>

SSL is used for sensitive stuff. Another layer (web service) is getting
pretty deep - ie - a VB6 app talking to an Access db on the local network is
pretty hot. Shift to .NET talking to a SQL db on the local network, and you
have a dog (not due to SQL). Put the db on a remote server and you have a
sick dog. Go through a web service on top of all of that, and you probably
have a dead dog (in addition to having to rewrite your app).

Anyway, maybe we are off topic here - the same problem exists on the LAN
even without the Internet. Why should a hacker on the local network be able
to attempt to sign on as sa (or any other login) 10 million times in a row
trying different passwords. Does anyone think that is a good design <g>?

Thanks
Russ Stevens

Relevant Pages

  • Re: Are ASP.NET user interfaces essentially dead now?
    ... it will be tight enough that you can't call SQL ... takes longer to develop ASP.NET interface than a windowsform app ... And communicating with a Web Service is not required the ... > I see Winforms doing the major amount of interface work and leaving the ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: SSL for very simple security need in web service app
    ... There is only a single end point here, a web service ... app that simply takes order info, validates it and applies it to a database. ... this is a common scenario. ... >>> userID ...
    (microsoft.public.dotnet.framework.aspnet.webservices)
  • Re: Going crazy trying to understand Web Services behaviour with static member fields, static classe
    ... is loaded for the life of the app domain (ASP.NET can recycle the app domain ... if I launch the exe 2 or more times each exe sees different things ... I think a web service is like a web page, so it lives only for the ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Cant find item in server side cache
    ... Then I used the url for web service when it was originally created which was ... So the web service and aspx ... page really were running in different instances of the web app. ... the web service returns the GUID back to the winform via the WS ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Stable application (non-stop, non-hanging...)
    ... You can have a CF app watchdogging another CF app it is just my suggestion ... that the dog is an eVC app. ... Here is the direct link to my IPC blog entry (I guess I need a search ... create a separate watchdog process. ...
    (microsoft.public.dotnet.framework.compactframework)