How to save secure / meta information into a file?

views:

answers:

+1 Q:

How to save secure / meta information into a file?

Hello,

I have somethings to store some data. Some of it information about how I'm implementing and other is some secure info like passwords,Activation code.

Now how do I store this info on a file (info.dat). I don't want user to see ANY of this data when he opens info.dat in a text editor.

What do I need to do?
How to do?

You could encrypt the sensitive data before writing it to the file.

Darin Dimitrov 2009-11-01 14:40:16

But when we write the encrypted data. I need to use some key, Which also should be stored. If user can find the encryption also. He can easily decrypt.So, again the problem is storing the key.

claws 2009-11-01 14:46:26

You have to store the key somewhere on that PC. So I can think of 2 options:1, Hide the key somewhere(like registry). But user can still find this if they have enough information.2, Using some system specific info as the key(like Mac ID, CPUID, etc). But again, user still can generate the key if they know what they are.

Ted Lee 2009-11-01 14:55:48

You could store the actual key on your servers, and have e.g. a webservice that will return the key based on the user's ID or something, and uses it for encryption/decryption, but never stores it on the user's local machine

marc_s 2009-11-01 14:56:18

Remember that no matter how hard you try if someone is determined to crack your software he will eventually succeed.

Darin Dimitrov 2009-11-01 15:09:12

@Darin: absolutely - it's always a question of how hard do you want to fight back against it ;-)

marc_s 2009-11-01 15:36:37

@Darin @marc_s I agree. I'm not aiming to make it impossible to crack. I'm just aiming for a difficult path.

claws 2009-11-01 16:00:00

@claws I think that @marc_s suggestion is very good. Storing the key on your server and using it to encrypt data is a nice solution.

Darin Dimitrov 2009-11-01 17:48:03

You could use an xml configuration file to store your licensing information. Use a hash of the file to verify that it has not been modified by the user. We use a private key to prevent modifying and rehashing. This way you do not have to hide and/or encrypt the file (which is also nice, if you have to look into the file for debugging purposes).

andyp 2009-11-01 16:23:35

ansaurus

tags:

views:

answers:

How to save secure / meta information into a file?

related questions