Mixing
How to save an email/password combination for windows program?
I am creating a windows service that has to send an email out at specific intervals to various people. I am using an account on a server that I need to connect with securely.
I found this reference: https://nimblegecko.com/how-to-store-login-details-securely-in-application-config-file/
the code I was trying to implement is this:
var configuration = ConfigurationManager.OpenExeConfiguration(Assembly.GetExecutingAssembly().Location);
configuration.AppSettings.Settings["username"].Value = EncryptString("new username", configPassword);
configuration.AppSettings.Settings["password"].Value = EncryptString("new password", configPassword);
configuration.Save();
My question is encoding the username and password as fixed text still seems to result in the same exposure as hard-coding it right?
any help would greatly be appreciated?
c# windows password-encryption
edited Jan 2 at 7:55
Tasos K.
6,75553149
asked Jan 2 at 1:28
JonJon
424521
add a comment |
I am creating a windows service that has to send an email out at specific intervals to various people. I am using an account on a server that I need to connect with securely.
I found this reference: https://nimblegecko.com/how-to-store-login-details-securely-in-application-config-file/
the code I was trying to implement is this:
var configuration = ConfigurationManager.OpenExeConfiguration(Assembly.GetExecutingAssembly().Location);
configuration.AppSettings.Settings["username"].Value = EncryptString("new username", configPassword);
configuration.AppSettings.Settings["password"].Value = EncryptString("new password", configPassword);
configuration.Save();
My question is encoding the username and password as fixed text still seems to result in the same exposure as hard-coding it right?
any help would greatly be appreciated?
c# windows password-encryption
edited Jan 2 at 7:55
Tasos K.
6,75553149
asked Jan 2 at 1:28
JonJon
424521
Read the encrypted UserName/Password from the AppConfig file (Dont write into it). The process of generating & updating appconfig can be done via separate app or manually. That way you can change passwords without impacting code.
– Prateek Shrivastava
Jan 2 at 2:49
This is area I have struggled in as well (using username/password within programs). The answers I see tend to be Salt and Hash and store. The running program willsalt and hashentry and check against stored hash. May be something to look into?
– Symon
Jan 2 at 2:51
How would I do that? I thought config files are app specific?
– Jon
Jan 2 at 2:51
add a comment |
I am creating a windows service that has to send an email out at specific intervals to various people. I am using an account on a server that I need to connect with securely.
I found this reference: https://nimblegecko.com/how-to-store-login-details-securely-in-application-config-file/
the code I was trying to implement is this:
var configuration = ConfigurationManager.OpenExeConfiguration(Assembly.GetExecutingAssembly().Location);
configuration.AppSettings.Settings["username"].Value = EncryptString("new username", configPassword);
configuration.AppSettings.Settings["password"].Value = EncryptString("new password", configPassword);
configuration.Save();
My question is encoding the username and password as fixed text still seems to result in the same exposure as hard-coding it right?
any help would greatly be appreciated?
c# windows password-encryption
edited Jan 2 at 7:55
Tasos K.
6,75553149
asked Jan 2 at 1:28
JonJon
424521
I am creating a windows service that has to send an email out at specific intervals to various people. I am using an account on a server that I need to connect with securely.
I found this reference: https://nimblegecko.com/how-to-store-login-details-securely-in-application-config-file/
the code I was trying to implement is this:
var configuration = ConfigurationManager.OpenExeConfiguration(Assembly.GetExecutingAssembly().Location);
configuration.AppSettings.Settings["username"].Value = EncryptString("new username", configPassword);
configuration.AppSettings.Settings["password"].Value = EncryptString("new password", configPassword);
configuration.Save();
My question is encoding the username and password as fixed text still seems to result in the same exposure as hard-coding it right?
any help would greatly be appreciated?
c# windows password-encryption
c# windows password-encryption
edited Jan 2 at 7:55
Tasos K.
6,75553149
asked Jan 2 at 1:28
JonJon
424521
edited Jan 2 at 7:55
Tasos K.
6,75553149
asked Jan 2 at 1:28
JonJon
424521
edited Jan 2 at 7:55
Tasos K.
6,75553149
edited Jan 2 at 7:55
Tasos K.
6,75553149
edited Jan 2 at 7:55
Tasos K.
6,75553149
6,75553149
asked Jan 2 at 1:28
JonJon
424521
asked Jan 2 at 1:28
JonJon
424521
asked Jan 2 at 1:28
JonJon
424521
424521
Read the encrypted UserName/Password from the AppConfig file (Dont write into it). The process of generating & updating appconfig can be done via separate app or manually. That way you can change passwords without impacting code.
– Prateek Shrivastava
Jan 2 at 2:49
This is area I have struggled in as well (using username/password within programs). The answers I see tend to be Salt and Hash and store. The running program willsalt and hashentry and check against stored hash. May be something to look into?
– Symon
Jan 2 at 2:51
How would I do that? I thought config files are app specific?
– Jon
Jan 2 at 2:51
add a comment |
Read the encrypted UserName/Password from the AppConfig file (Dont write into it). The process of generating & updating appconfig can be done via separate app or manually. That way you can change passwords without impacting code.
– Prateek Shrivastava
Jan 2 at 2:49
This is area I have struggled in as well (using username/password within programs). The answers I see tend to be Salt and Hash and store. The running program willsalt and hashentry and check against stored hash. May be something to look into?
– Symon
Jan 2 at 2:51
How would I do that? I thought config files are app specific?
– Jon
Jan 2 at 2:51
Read the encrypted UserName/Password from the AppConfig file (Dont write into it). The process of generating & updating appconfig can be done via separate app or manually. That way you can change passwords without impacting code.
– Prateek Shrivastava
Jan 2 at 2:49
Read the encrypted UserName/Password from the AppConfig file (Dont write into it). The process of generating & updating appconfig can be done via separate app or manually. That way you can change passwords without impacting code.
– Prateek Shrivastava
Jan 2 at 2:49
This is area I have struggled in as well (using username/password within programs). The answers I see tend to be Salt and Hash and store. The running program will
salt and hash entry and check against stored hash. May be something to look into?– Symon
Jan 2 at 2:51
This is area I have struggled in as well (using username/password within programs). The answers I see tend to be Salt and Hash and store. The running program will
salt and hash entry and check against stored hash. May be something to look into?– Symon
Jan 2 at 2:51
How would I do that? I thought config files are app specific?
– Jon
Jan 2 at 2:51
How would I do that? I thought config files are app specific?
– Jon
Jan 2 at 2:51
add a comment |
3 Answers
3
active
oldest
votes
Uhm... Don't store in AppConfig settings.
If you cannot use a database for that (storing hashed and encrypted strings) get a new file for that, you can even protect it to allow only the service user account to read/modify it, or store it on the service profile directory (its user account profile directory)
I would do it using an ini file structure more easy to read than an xml, where each line contains something like
var mergedCredential = string.Format("{0}|{1}", "user@here.com" , "P@ssw0rd");
User1HashedCredentials=EncryptString("new username", mergedCredential);
I used a pipe to "merge" the credential as you can prevent users to use it on username
When you decrypt you split by "|"
var credentials = DecryptString("new username", User1HashedCredentials);
var splitted = credentials.Split('|');
Username = splitted[0]
Password = splitted[1]
An example of ini file:
[Users]
Count=5
[SendEmailSection]
User1=dsaa$#asdasd$#@rr==
User2=dggggjh7/sd$#@rr==
User3=dsaasd"/$%asdasd$#@rr==
User4=dsas/&"dasd$#@rr==
User5=dsAa&s3dasd$#@rr==
Which is easier to mantain and modify. You can even make your own specialized ini reader/writer Read sections, split by "="
answered Jan 2 at 4:43
Jorge RojasJorge Rojas
440310
add a comment |
I do not suggest to store credential in app.config file. if you are planned to store there then you should store with proper encryption and decryption.
for you info you can refer this link
But I would suggest you to use window credential manager to store your password
for more details you can use their nuget package and their sample
Nuget
Another reference
Github
answered Jan 2 at 4:55
divyang4481divyang4481
39528
add a comment |
You can find it in your app's Preferences.
Right click on your project. Select add. Add .settings form. Then crate a table which contains email, password etc.
answered Jan 2 at 8:13
Everybody voting down my Qs.Everybody voting down my Qs.
26
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54000267%2fhow-to-save-an-email-password-combination-for-windows-program%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
3 Answers
3
active
oldest
votes
3 Answers
3
active
oldest
votes
active
oldest
votes
active
oldest
votes
Uhm... Don't store in AppConfig settings.
If you cannot use a database for that (storing hashed and encrypted strings) get a new file for that, you can even protect it to allow only the service user account to read/modify it, or store it on the service profile directory (its user account profile directory)
I would do it using an ini file structure more easy to read than an xml, where each line contains something like
var mergedCredential = string.Format("{0}|{1}", "user@here.com" , "P@ssw0rd");
User1HashedCredentials=EncryptString("new username", mergedCredential);
I used a pipe to "merge" the credential as you can prevent users to use it on username
When you decrypt you split by "|"
var credentials = DecryptString("new username", User1HashedCredentials);
var splitted = credentials.Split('|');
Username = splitted[0]
Password = splitted[1]
An example of ini file:
[Users]
Count=5
[SendEmailSection]
User1=dsaa$#asdasd$#@rr==
User2=dggggjh7/sd$#@rr==
User3=dsaasd"/$%asdasd$#@rr==
User4=dsas/&"dasd$#@rr==
User5=dsAa&s3dasd$#@rr==
Which is easier to mantain and modify. You can even make your own specialized ini reader/writer Read sections, split by "="
answered Jan 2 at 4:43
Jorge RojasJorge Rojas
440310
add a comment |
Uhm... Don't store in AppConfig settings.
If you cannot use a database for that (storing hashed and encrypted strings) get a new file for that, you can even protect it to allow only the service user account to read/modify it, or store it on the service profile directory (its user account profile directory)
I would do it using an ini file structure more easy to read than an xml, where each line contains something like
var mergedCredential = string.Format("{0}|{1}", "user@here.com" , "P@ssw0rd");
User1HashedCredentials=EncryptString("new username", mergedCredential);
I used a pipe to "merge" the credential as you can prevent users to use it on username
When you decrypt you split by "|"
var credentials = DecryptString("new username", User1HashedCredentials);
var splitted = credentials.Split('|');
Username = splitted[0]
Password = splitted[1]
An example of ini file:
[Users]
Count=5
[SendEmailSection]
User1=dsaa$#asdasd$#@rr==
User2=dggggjh7/sd$#@rr==
User3=dsaasd"/$%asdasd$#@rr==
User4=dsas/&"dasd$#@rr==
User5=dsAa&s3dasd$#@rr==
Which is easier to mantain and modify. You can even make your own specialized ini reader/writer Read sections, split by "="
answered Jan 2 at 4:43
Jorge RojasJorge Rojas
440310
add a comment |
Uhm... Don't store in AppConfig settings.
If you cannot use a database for that (storing hashed and encrypted strings) get a new file for that, you can even protect it to allow only the service user account to read/modify it, or store it on the service profile directory (its user account profile directory)
I would do it using an ini file structure more easy to read than an xml, where each line contains something like
var mergedCredential = string.Format("{0}|{1}", "user@here.com" , "P@ssw0rd");
User1HashedCredentials=EncryptString("new username", mergedCredential);
I used a pipe to "merge" the credential as you can prevent users to use it on username
When you decrypt you split by "|"
var credentials = DecryptString("new username", User1HashedCredentials);
var splitted = credentials.Split('|');
Username = splitted[0]
Password = splitted[1]
An example of ini file:
[Users]
Count=5
[SendEmailSection]
User1=dsaa$#asdasd$#@rr==
User2=dggggjh7/sd$#@rr==
User3=dsaasd"/$%asdasd$#@rr==
User4=dsas/&"dasd$#@rr==
User5=dsAa&s3dasd$#@rr==
Which is easier to mantain and modify. You can even make your own specialized ini reader/writer Read sections, split by "="
answered Jan 2 at 4:43
Jorge RojasJorge Rojas
440310
Uhm... Don't store in AppConfig settings.
If you cannot use a database for that (storing hashed and encrypted strings) get a new file for that, you can even protect it to allow only the service user account to read/modify it, or store it on the service profile directory (its user account profile directory)
I would do it using an ini file structure more easy to read than an xml, where each line contains something like
var mergedCredential = string.Format("{0}|{1}", "user@here.com" , "P@ssw0rd");
User1HashedCredentials=EncryptString("new username", mergedCredential);
I used a pipe to "merge" the credential as you can prevent users to use it on username
When you decrypt you split by "|"
var credentials = DecryptString("new username", User1HashedCredentials);
var splitted = credentials.Split('|');
Username = splitted[0]
Password = splitted[1]
An example of ini file:
[Users]
Count=5
[SendEmailSection]
User1=dsaa$#asdasd$#@rr==
User2=dggggjh7/sd$#@rr==
User3=dsaasd"/$%asdasd$#@rr==
User4=dsas/&"dasd$#@rr==
User5=dsAa&s3dasd$#@rr==
Which is easier to mantain and modify. You can even make your own specialized ini reader/writer Read sections, split by "="
answered Jan 2 at 4:43
Jorge RojasJorge Rojas
440310
answered Jan 2 at 4:43
Jorge RojasJorge Rojas
440310
answered Jan 2 at 4:43
Jorge RojasJorge Rojas
440310
answered Jan 2 at 4:43
Jorge RojasJorge Rojas
440310
440310
add a comment |
add a comment |
I do not suggest to store credential in app.config file. if you are planned to store there then you should store with proper encryption and decryption.
for you info you can refer this link
But I would suggest you to use window credential manager to store your password
for more details you can use their nuget package and their sample
Nuget
Another reference
Github
answered Jan 2 at 4:55
divyang4481divyang4481
39528
add a comment |
I do not suggest to store credential in app.config file. if you are planned to store there then you should store with proper encryption and decryption.
for you info you can refer this link
But I would suggest you to use window credential manager to store your password
for more details you can use their nuget package and their sample
Nuget
Another reference
Github
answered Jan 2 at 4:55
divyang4481divyang4481
39528
add a comment |
I do not suggest to store credential in app.config file. if you are planned to store there then you should store with proper encryption and decryption.
for you info you can refer this link
But I would suggest you to use window credential manager to store your password
for more details you can use their nuget package and their sample
Nuget
Another reference
Github
answered Jan 2 at 4:55
divyang4481divyang4481
39528
I do not suggest to store credential in app.config file. if you are planned to store there then you should store with proper encryption and decryption.
for you info you can refer this link
But I would suggest you to use window credential manager to store your password
for more details you can use their nuget package and their sample
Nuget
Another reference
Github
answered Jan 2 at 4:55
divyang4481divyang4481
39528
edited Jan 2 at 5:28
answered Jan 2 at 4:55
divyang4481divyang4481
39528
answered Jan 2 at 4:55
divyang4481divyang4481
39528
answered Jan 2 at 4:55
divyang4481divyang4481
39528
39528
add a comment |
add a comment |
You can find it in your app's Preferences.
Right click on your project. Select add. Add .settings form. Then crate a table which contains email, password etc.
answered Jan 2 at 8:13
Everybody voting down my Qs.Everybody voting down my Qs.
26
add a comment |
You can find it in your app's Preferences.
Right click on your project. Select add. Add .settings form. Then crate a table which contains email, password etc.
answered Jan 2 at 8:13
Everybody voting down my Qs.Everybody voting down my Qs.
26
add a comment |
You can find it in your app's Preferences.
Right click on your project. Select add. Add .settings form. Then crate a table which contains email, password etc.
answered Jan 2 at 8:13
Everybody voting down my Qs.Everybody voting down my Qs.
26
You can find it in your app's Preferences.
Right click on your project. Select add. Add .settings form. Then crate a table which contains email, password etc.
answered Jan 2 at 8:13
Everybody voting down my Qs.Everybody voting down my Qs.
26
answered Jan 2 at 8:13
Everybody voting down my Qs.Everybody voting down my Qs.
26
answered Jan 2 at 8:13
Everybody voting down my Qs.Everybody voting down my Qs.
26
answered Jan 2 at 8:13
Everybody voting down my Qs.Everybody voting down my Qs.
26
26
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54000267%2fhow-to-save-an-email-password-combination-for-windows-program%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Read the encrypted UserName/Password from the AppConfig file (Dont write into it). The process of generating & updating appconfig can be done via separate app or manually. That way you can change passwords without impacting code.
– Prateek Shrivastava
Jan 2 at 2:49
This is area I have struggled in as well (using username/password within programs). The answers I see tend to be Salt and Hash and store. The running program will
salt and hashentry and check against stored hash. May be something to look into?– Symon
Jan 2 at 2:51
How would I do that? I thought config files are app specific?
– Jon
Jan 2 at 2:51