|
francis-09 wrote: Is there a best practice where the "master-password" should be put?
How about database?
Yusuf
Oh didn't you notice, analogous to square roots, they recently introduced rectangular, circular, and diamond roots to determine the size of the corresponding shapes when given the area. Luc Pattyn[^]
|
|
|
|
|
Instead of saving the password, calculate a hash-value based on the password. Once the user enters his/her password, calculate a new hash. Compare this calculated value against the hash-value that you have stored (and encrypted).
You might want to adapt the example from MSDN[^] for your purpose 
I are troll
|
|
|
|
|
Sorry, i did not explain the purpose, I'm up to very well.
My application will not require user-authentication "with itself", but will be used at an intermediate piece to another software.
|
|
|
|
|
when you say 'master-password' do you mean a key that is used for encryption/decryption? or do you mean a password for an admin account incase all other username/password combinations are forgotten?
also, does you application work on a network? i.e. with a central database. Or is it just for local machine usage?
Life goes very fast. Tomorrow, today is already yesterday.
|
|
|
|
|
I mean a key that is used internally for encryption/decryption. In the end it should be a similiar functionality as the firefox or opera password wizard. Sorry, I perhaps explained that abigously.
The application will also be just for local machine usage.
Thanks, so far
|
|
|
|
|
Hmmmm, well the key needs to be stored locally then.
So i think hardcoding is just as safe as any other option. if you hardcode then the key can posibly be recovered from the executable. but if you store in any other file then you have the same issue. you could store in an external file that you encrypt with a hardcoded key ( just a little extra effort to hack). maybe use some sort of obfuscator[^] on your application.
Alternatively maybe you could consider using a different key for each logged in user. maybe stored in a file in thier user folders, or perhaps a 'hash' of thier user Guid. I would personally give this approach a try.
But these are just suggestions, and i cant say for sure if they are best options
Life goes very fast. Tomorrow, today is already yesterday.
|
|
|
|
|
Best practice on saving passwords = don't.
Any techniques that rely on storing a password to a password to a password are inherently unsafe.
Hasing the password (as already suggested) would be OK as long as the hashing algorithm used is safe (try SHA 256)
|
|
|
|
|
I searched through the net to find the best solution to do this, but about 90% answer are the same. "DON'T SAVE, USE HASING".
Please, stop to give a solution to use salt or hashing.
because i think the scenario is different.
and I think someone asked about it is already known well about hashing.
Let me explain about my own problem:
1. How do you use hashing if your application should logged in to several services that need a plain password?
2. How do you use hashing for "Save my password" check box below the login form? yes better don't put it.. but how do i satisfy my user about this?
Sorry, Don't meant to be offense.
But it is a bit anoying to face the same answer if you in rush 
Best Regards
Tutnik
Kin
|
|
|
|
|
Well, ok, the post was a bit old but why not..
1) Sure, if you need the plaintext password then you need it, that's the other services' fault then for requiring you to use potentially unsafe techniques..
2) That kind of information really should be stored client-side.. otherwise there basically isn't any password protection at all right? And if the client side is getting hacked, there is nothing you can do anyway, it's fundamentally impossible to know the difference between a user and a malicious program that is inadvertently ran by the user
It is true that the usual answer of "DONT SAVE IT" is getting old/annoying, but some people just don't know about security - maybe the same people who keep trying to hide/encrypt things from the user himself.. (sometimes they even want to encrypt the code - as if that's going to do anything)
edit: I don't really think that this was a case where the OP would need to store the plaintext password - the user would be entering it anyway so if the hashes match you have your plaintext
|
|
|
|
|
I am using Visual Studio 2008 SP1. My problem is that the only reporting-related toolbox items I see are 5 "Textbox" controls. Where are the other stuff? Do I need to add a reference to a different assembly?
Here are the steps I take:
1) Open Visual Studio
2) Add new project --> "Reports Application"
3) Open Report1.rdlc
4) Open the toolbox and no controls are available (except the repeating 5 Textbox controls)
Many thanks in advance
Kind regards,
The only programmers that are better C# programmers, are those who look like this -> ![Green Alien | [Alien]](https://www.codeproject.com/script/Forums/Images/alien.gif) |
Programm3r
My Blog: ^_^
|
|
|
|
|
This link[^] will help!
or
Perform the following steps:
Locate the directory %USERPROFILE%\Local Settings\Application Data\Microsoft\VisualStudio\8.0 and delete the four (hidden) files: toolbox.tbd, toolbox_reset.tbd, toolboxIndex.tbd, toolboxIndex_reset.tbd. Start VS and open the toolbox (This will take a while). Note: You lose all user-added items from the toolbox.
Regards,
The only programmers that are better C# programmers, are those who look like this -> ![Green Alien | [Alien]](https://codeproject.freetls.fastly.net/script/Forums/Images/alien.gif) |
 Programm3r
My Blog: ^_^
|
|
|
|
|
Hi everyone
How i can close WiFi and BT in WinCE ?
I work in C# VS2008
thank's in advance
|
|
|
|
|
Hello, I have tried to use NUnit to test C# code that is already connected to C++ code (without the NUnit the application work perfectly).
In my test I run the main function through AppDomain.CurrentDomain.ExecuteAssembly(..), However when the C# code tries to "communicate" with the C++ it throws an exception and the test crashes. The exception is System.Reflection.TargetInvocationException if anyone has and idea why its happen it will be very very helpful... Thanks, Naama
|
|
|
|
|
naamalev wrote: In my test I run the main function through AppDomain.CurrentDomain.ExecuteAssembly(..),
Can you post code here? What did the inner exception says?
|
|
|
|
|
Dear Friend,
I have downloaded one application from Code project it seems like very good application to visualize any kind of summary quickly by chart.
But when I opened the project in VS 2005 it gives me error on design time as "Error in creating control Child nodes not allowed”
How can I fix this problem?
Your quick response will be highly appreciated.
Regards
Murtuza
|
|
|
|
|
Post in the message section below the article - or debug the code yourself.
DaveBTW, in software, hope and pray is not a viable strategy. (Luc Pattyn)Visual Basic is not used by normal people so we're not covering it here. (Uncyclopedia)
|
|
|
|
|
I am an Msc computer science student.As part of our studies, i have 6 months project.I have selected the topic 'email notification of file system changes in c#'. Please give me the description and source code of this project.Also suggest the modules that can be included in this project and rate it(ie is it suffiicient for a 6 month project)
|
|
|
|
|
vinithakizhussery wrote: i have 6 months project.I have selected the topic 'email notification of file system changes in c#'. Please give me the description and source code of this project.
You have got to be kidding me. It is your project. You must do the work!
You must create the source code. As for giving you the description.... How can I give you a description for that project. It is YOUR project! I don't know anything about it.
vinithakizhussery wrote: is it suffiicient for a 6 month project
Any competent professional C# developer should be able to manage a proof of concept in an afternoon.
|
|
|
|
|
vinithakizhussery wrote: Please give me the description and source code of this project.
You're learning to ask for sourcecode? Your question isn't very inviting, is it? 
There's a component that can notify you on any changes in the filesystem. There's a component that can send emails. You'd only need to hook up the user-interface to existing functionality. I'd timeframe it on a 2 month-project, including research and documentation
I are troll
|
|
|
|
|
Look, your post graduate project time framed for 6 months is a tiny piddly thing which really involves wiring up two existing components in the .NET Framework. There is nothing at all innovative in this. As I said you could put a proof of concept together in an afternoon. In order to do all the research and documentation behind it will take a wee bit longer, but then I compare what you are doing for a post-graduate degree to what I did for my under-graduate degree 14 years ago. Now, 14 years ago the tools were more primitive and I had to do a heck of a lot more work and yet I managed to turn in a working Geographical Information System that could read Ordnance Survey map data. You could pan and zoom around the map, turn on and off various map features, change the styles, select stuff on the map and perform spatial queries on it and so on. I had to write my own code for practically everything because I didn't have fancy frameworks to do most of what I had to achieve.
If this is the state of education these days then we shall surely end up worse up much worse off before long.
|
|
|
|
|
Colin Angus Mackay wrote: I had to write my own code for practically everything because I didn't have fancy frameworks
There should be a Q.0 in every computing related exam asking for a definition of a trivial concept, say an array. The question should carry no more than 1% of the final mark, but if the examinee cannot answer 100% the question then they fail the entire exam.
F'em if they can't take it!
Panic, Chaos, Destruction.
My work here is done.
|
|
|
|
|
Never mind your undergrad work; the DOS based tetris game i wrote my junior year of HS at a final project over the course of about 2 months is a few orders of magnitude greater in scope than this kidiot's farce. 
Today's lesson is brought to you by the word "niggardly". Remember kids, don't attribute to racism what can be explained by Scandinavian language roots.
-- Robert Royall
|
|
|
|
|
Even better: Just send an email notification to your teacher that you are no good for this subject.
|
|
|
|
|
|
Every time I see a post like this I think there should be a requirement that you have to be a member for a month before you're allowed to post anything.
Scott
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
