hide password in string

Question

I am making a custom ftp client that logs onto a single ftp site and goes to a specific folder to avoid users' putting files in the wrong place.

I'm not super concerned about it, but the password is just a string to initiate the new ftp object.

FtpClient ftp = new FtpClient("www.markonsolutions.com", "user", "password");

What is the best way to keep this password from prying eyes?

Answer 1

See this SO post about how to encrypt and decrypt a string, in this case your password.

You should also consider obfuscating your code to make it difficult for people with appropriate tools to get the password by debugging your code.

Answer 2

You can use this to protect your plain text string from reflector like programs.

Answer 3

FTP supports only plain text authentication - if you want to hide the password from attackers you have to use FTPS (FTP over SSL).

UPDATE

Don't care about hiding and obfuscating the password in your source code as a first step - your application will have to decrypt it and send it over the wire in plain text. Everyone can just start WireShark or any other packet sniffer and get the password back in plain text. First make sure that you don't send the password in plain text over a network, then start thinking about obfuscating it in your code.

UPDATE

Obfuscating the password in your code yields no security at all while you are sending it in plain text, but you can do so. Just encrypting the string adds one level of indirection. Without obfuscation I have to finde the password in your application and that's a matter of minutes with Reflector, with obfuscation I have to find the key, the encrypted password, and the encryption method. This will probably still take only minutes.

Using an obfuscator to prevent me from decompiling you application (into readable code) might stop me for a few hours until I find the relevant call into a system library function (but I wouldn't try, but only read the password from the wire ;).

So I suggest not to try to hard to obfuscate the password - the average user is probably unable to find a plain text password in a executable and people willing to find the password cannot be stopped by obfuscation. In this case the only way would be not to include the password in your application in the first place.

Answer 4

Make your passwords and connection URLs configuration parameters, in a protected file. I uses INI files, and they are placed in a directory that is protected by the web server such that a browser can't open nor see the file/directory.