0

A theoretically question:

I have a C# Windows Form app, that sends back some user submitted data to an external mySQL server on the internet. How do I prevent people from seeing the username and password for the mySQL server? (Eg. by decompiling the C# exe program).

Best regards

Improve this question
3
  • 2
    Don't keep it in the source code? Commented Mar 27, 2012 at 14:17
  • Obfuscation can be a solution.. But I would rather use a web service for this type of things... Commented Mar 27, 2012 at 14:18
  • use a third party authentication provider such as OpenID Commented Mar 27, 2012 at 14:20

4 Answers 4

Reset to default
3

Short answer: you can't - anything that runs on a machine you don't control can be decompiled etc.

Possible option:

You might try an approach with a SSL-secured webservice on server-side which authenticated clients via client-cert (part of SSL standard). That webservice would be accessing the DB on behalf of the clients. you can then secure the connection between webservice and DB network-wise...

Improve this answer
Sign up to request clarification or add additional context in comments.

4 Comments

thats great until someone steals the client cert.
@boo that is a solvable problem: you can invalidate the client-cert and issue a new one... you can even have a different client-cert per user which makes invalidating much less problematic since only that one user would need a new one (an all others can just work without even noticing that there has been an invalidation).
at which point you are no better off than issueing per-user passwords in terms of maintainability, probably worse as it is more expensive to develop a certificate management system than a password management system.
@Boo I did both in the past and I can assure you that the cert-based approach is by far easier to implement and maintain...
1

Typically you either prompt the user for a credential, or you if the account is public (eg. credentials are insecure, as in your case) you limit what the account is allowed to do.

Improve this answer

Comments

1

I would pass the user submitted data to another service which does the actual talking to the database server. That way your connection details can be kept apart from the client.

If you cannot do that then you should create a restricted account for your mySQL database which is used by your client code.

Improve this answer

Comments

0

Live with the fact, that everything the client software knows is known to the user.

Set up the smallest possible interface for he client software to use. Instead of exposing a full DB account, use one restricted to some stored procedures only. Or don't access DB directly, but via a (web) service. Then, make sure the service only exposes safe-to-execute methods.

Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.