Securing a password in source code?

Question

I have a password in my code which is needed to connect to a sftp server. Whats the best way to \"obfuscate\" or hide it in the code?

Thanks

Answer 1

I actually consider using the "protected sections" feature in App.Config or Web.Config to be LESS secure than storing the password in your code.

Anyone with server access can decrypt that section of the config just as quick as you encrypted it by running the decrypt command described in the article everyone keeps quoting:

aspnet_regiis -pd "connectionStrings" -app "/SampleApplication"

https://msdn.microsoft.com/en-us/library/zhhddkxy.aspx#Anchor_1

So this feature of ASP.Net only adds security in the case that a hacker somehow had access to your web.config but not your entire server (happened in 2010 as @djteller mentioned in the oracle padding attack comment). But if they do have server access, you're exposed in one cmd call. They don't even have to install ildasm.exe.

However, storing actual passwords in your code is a maintenance nightmare. So one thing I've seen done is storing an encrypted password in your web.config and storing the encryption key in your code. This accomplishes the goal of hiding passwords from casual browsing while still being maintainable.

In this case a hacker has to at least decompile your code, find your key, and then figure out what encryption algorithm you're using. Not impossible, but certainly harder than running "aspnet_regiis -pd...".

Meanwhile I am also looking for better answers to this six year old question...

Answer 2

There are no "best way" to store password in source code since it can be recovered in many ways.

You can obfuscate password string or even encrypt it to prevent reveal thru simple viewing but it can't be treated as serious protection.

Answer 3

Don't save your password in the source code.

Read this: http://en.wikipedia.org/wiki/Security_through_obscurity

There is no good way.

All you can do is use a smart algorithm to encrypt the password.

An experienced reverse engineer would manage to crack it.

Answer 4

You can put it as an encrypted value in the web.config file. It doesn't look too hard: K scott Allen tutorial http://odetocode.com/blogs/scott/archive/2006/01/08/encrypting-custom-configuration-sections.aspx

I think there's a Scott gu blog post with links to other information. http://weblogs.asp.net/scottgu/archive/2006/01/09/434893.aspx