How safe is it to use the encrypted appSettings element in app.config?

Question

In a CodingHorror post, the commentator remarked that it is more difficult to hide confidential configuration information (such as SQL Server connection strings) in a program than before because the hide algorithm can be easily removed using Reflector .

Another commenter suggested that encrypted appSettings could be used as an alternative.

How securely is appSettings encrypted? Is it a bank vault, a locked door or an open window and why? Is it always safe to store "confidential information" in an executable file?

Answer 1

Encryption algorithms are secure: the main problem with using encryption for security is secure key management.

Hiding application executable keys has never been safe, but it is probably true that they are easier to find in a managed executable using a tool such as Reflector than in a traditional unmanaged executable.

Encryption of the configuration file may be useful on the server. For example, if you encrypt web.config using DPAPI using a machine key, only users who can log into the server or have write access to the server disk can decrypt it:

Anyone who has read access to the server disk over the network or access to a backup copy of the application directory will not be able to decrypt it.

Answer 2

The real question is: who are you trying to protect the user and password? In a desktop application, the user will most likely have access to the database with his / her own account, no pwd (trusted) is needed. In the web application, the configuration file is in a secure place (hopefully). So far, I have not found many reasons for encrypting the configuration file.