Geek Answers Handbook

Saving passwords in the registry as "secrets"

I need to store the name / password of my users somewhere (preferably a registry), so my .Net application can use them to log into some remote service on behalf of the user. I know that you can store values ​​in the registry as "secrets", which means encrypting them using a Windows domain user token or something like that. In other words, I do not want to deal with the encryption itself.

To clarify: I cannot store password hashes or salt them or anything else. These credentials are for a third-party system and only so that I can log into this system on behalf of my users in one way or another to save their credentials and restore them.

One way or another, I vaguely remember such a place in the registry, but the details are grim. And I need to do this in C # (although if it's easy access to the registry, it doesn't matter).

Edit: One more thing, it should persist between Windows user sessions (IOW this does not help me if the password is unreadable after the user has logged out and logged out).

+6
c # passwords encryption registry
source share
4 answers

You are probably thinking of a data protection API. Find MSDN or read some blogs and see if this works for you.

+10
source share

You can try using System.Security.Cryptography.ProtectedData, which can encrypt them using a user key. http://msdn.microsoft.com/en-us/library/system.security.cryptography.protecteddata.aspx.

This is not completely safe, because code executed as a user can decrypt the data.

+5
source share

Keep in mind that you are not really saving anything if you can automatically (without user input) recover the password. Using RSA, symmetric or other encryption does not matter as long as you store the decoding key in your application. When someone gets the key, the secret.

However, the data protection API mentioned above must protect passwords from other users on the same computer. (This sounds like DPAPI uses your credentials for encryption.)

For a few more options, check the msdn page for Threat Threat .

+1
source share
  • You should never store credentials as plain text. Use a symmetric encryption key. Print the password at run time. See the MSDN link in the cryptography function.
0
source share

More articles:


All Articles