Hi!
A user types a specific username and password, that username and password is in the program converted to something else! But... that password is in my program plain text, in the source code. Is that safe? Can people somehow get that out? What can I do to prevent that? Can people somehow decompile my program and read that password?
Just curious!
Thank you!
No, it is not safe.
Yes, it is very easy to retrieve it using Reflector.
If you are in a Domain, then using Windows Authentication is suggested.
No, as already answered, the source can be disassembled with Reflector or ildasm.
If you must keep the credentials in the source code then consider using hash encryption.
You should never store any secret or sensitive data in code. EVER! store it in a config file and lock the config file down to only trusted users.
Do not store the password in plaintext.
If you can, do your authentication using operating system services.
If you can't do that (or don't want too), store the hash of the desired password, which is generated by a secure hash algorithm, such as SHA. A hash function is what is called a "one way function", that is, given an input, it is easy to get an output, but given an output, its very difficult if not impossible to get the input. When your program runs, have the user enter his password, compute the hash on-the-fly, and then compare the users hash with the stored hash.
Hashing is a very easy way to go, and if you pick a good hash algorithm, should be safe enough.