Alex Rivera | Logout

using securestring for a sql connection

Asked 2009-12-17T15:02:03.257
10

I want to use a SecureString to hold a connection string for a database. But as soon as I set the SqlConnection object's ConnectionString property to the value of the securestring surely it will become visible to any other application that is able to read my application's memory?

I have made the following assumptions:
a) I am not able to instantiate a SqlConnection object outside of managed memory
b) any string within managed memory can be read by an application such as Hawkeye

c# .net securestring
Edit
Report

1 Answer

0

Why is the connection string an issue? Wouldn't the password be what you want to protect (unless you're putting the password in the connection string which is optional for all drivers that I've seen). That being said, the password will usually have to be "in the clear" in memory at some point (unless the driver has some api that allows encrypted passwords or something, but that probably wouldn't actually help much anyway).

Usually this is not a problem because the process is in a secure environment, like on a web server, or running as a system admin type of account (so normal users cannot access the process memory), or usually both. If this is on a client's machine running in userland you must assume that the process is compromised anyway and this wouldn't help. Once you secure the process you don't have to worry about things like this.

answered 2009-12-17T15:27:21.837

Your Answer