C # - Securely saving a password locally

Question

I am creating a C # application that blocks functionality (keyboard shortcuts, Windows taskbar, etc.) in a kiosk-style environment. One of the requirements is that some people can still exit the application using the key combination and password.

The application itself is fully executed, but I did not find a good way to store and verify the password. Everything should be stored locally (no check on the network database or anything else). How can I determine the password to unlock my application and also make it flexible (the ability to change the password without recompiling the application). How can I accomplish this in a safe way?

Answer 1

The standard method for storing a password in a configuration file is to use a strong hashing algorithm. Read the answer to How to store passwords in a Winforms application? and possibly a wiki article at https://en.wikipedia.org/wiki/Cryptographic_hash_function

Answer 2

Keep a secure password hash; it should not be reversible.

When someone enters a password, you mean that by the same algorithm and checks if it matches the hash.

Because you never store the actual password that it protects.

I recommend using a key stretching algorithm such as PBKDF2..Net supports this with Rfc2898DeriveBytes , or you can use System.Web.Helpers.Crypto .

Answer 3

You can store the hash of your key and password somewhere, for example, in some local file. When the user enters the key and password, you get hashes for these values ​​and compare it with the hashes in your file.

Answer 4

I do not agree with Brian, because at the moment the standard method for storing passwords in any database is the "salt" (see Wikipedia for a detailed explanation) password with a randomly generated value and save the hashed value and salt in your "database" ( see notes). Salt is not a secret, so you can store it in plain text. Whenever a user enters a password, you read the salt from your file, apply it to the entered password, and then apply the hash algorithm of your choice. Then you compare the results with the stored hash. If they match, the user is authenticated. For a good (and interesting :)) explanation of why “just” password hashing is not enough, see: HOW NOT TO STORE PASSWORDS! For educational implementation of the salting and hashing process in C # see C # Salting and Hashing Passwords

You can also find a good way to do this here: https://stackoverflow.com/a/166268/

For quick reference, the process in pseudo-code:

First password store:

 //get user input username = GetUserName password = GetPassword //generate random salt salt = GetRandomValue //combine password and salt and apply hash hashedPassword = Hash(password + salt) //store hash value and salt in database AddToDatabase(username, hashedPassword, salt) 

User Login:

 //get user input username = GetUserName password = GetPassword //read salt from database salt = GetSaltFromDatabase(username) //combine password and salt and apply hash hashedPassword = Hash(password + salt) //compare hash to stored hash value correctHash = GetHashFromDatabase(username) if (hashedPassword == correctHash) then passwordIsCorrect = True else passwordIsCorrect = False end if 

Note:

• This assumes that your usernames are unique, as they are used as an identification key in your "database".
• A “database” does not have to be any “real” database, it can also be your configuration file or a text file.

Answer 5

You need a password hash and validation using hashed text. Adding salt can make your password more secure. On .Net, you can use System.Security.Cryptography.RNGCryptoServiceProvider .

Here's a good article on how to store your passwords, and I use my path in my web application.

Answer 6

It is relatively easy to use the ProtectSection() and UnprotectSection() methods from the SectionInformation class. See this article:

http://www.davidgiard.com/2012/06/05/EncryptingAndDecryptingApplicationConfigSections.aspx

http://msdn.microsoft.com/en-us/library/system.configuration.sectioninformation.protectsection.aspx