views:

98

answers:

2

Hi,

I have a desktop application developed in C#.NET, with an encrypted database. The encryption password is hard coded in the application code.

How can I hide this password, since the code can be accessed through a .net disassembler?

Maybe obfuscate the code could be a solution, but how do I create a setup for the application with the obfuscated code, because every time I rebuild the setup, a brand new .exe is created and the code is never obfuscated.

I hope someone knows how to get around this.

+2  A: 

My suggestion is to not do this and here's why: SCADA

Woot4Moo
A: 

You definitely want to look into some for of encryption, some professional obfuscators will encrypt string information in an assembly as well.

Capital G
Is this the "turtles all the way down" school of cryptography? Sure, you can add another layer of encryption. But if the desktop application is to access the database, it must have all the required keys. And that means those keys *will* be accessible to disassemblers and/or debuggers.
Matthew Flaschen