|
Hi, guys
I want to add a password for my application. But I don't know where to store the username and password. In fact, I don't hope a special file to store them. Whether I can store them into register table. And how?
Or other correct place to stroe them but I don't know.
Wish some useful idea.
Thank you very much!
vigorous
|
|
|
|
|
You don't tell us anything about your application. That would generally determine where would be a sensible place.
Wherever you store this information it is important to encrypt the passwords. Preferably using a one way encryption so when they user types their password, you encrypt what they typed and compare the two encrypted strings.
I just got a letter from equiTalk today who provide cheap telephone calls and in it they put in a nice little side box my phone number, email address, account number and PASSWORD. To put my reaction diplomatically: I was severely unimpressed.
"You can have everything in life you want if you will just help enough other people get what they want." --Zig Ziglar
The Second EuroCPian Event will be in Brussels on the 4th of September
Can't manage to P/Invoke that Win32 API in .NET? Why not do interop the wiki way!
My Blog
|
|
|
|
|
In fact ,what I need is quite simple, Just an identity window which user can enter a username and password. If they are correct, user could enter the following interface. Just so simple. And there is a non-connected application.
Now I understand DPAPI could protect the password and database.But what I really care is where to store the username and password. Because in my application, even the password is not encrypted, it is alos ok. And I don't hope to use a seperate file to do that
Please give me a correct direction
Thank you
vigorous
|
|
|
|
|
wk_vigorous wrote:
even the password is not encrypted
ENCRYPT THE PASSWORD! People share the same password between many applications, quite simply the average person today is overloaded with passwords to remember, so they take the easy route and have only a small number of passwords they reuse. If you leave the password exposed you are leaving your user exposed. TAKE SOME RESPONSIBILITY FOR THIS.
You cannot believe how irritated I am when I see that someone has not taken the time to secure my personal information. I count passwords as highly sensitive personal information. 
"You can have everything in life you want if you will just help enough other people get what they want." --Zig Ziglar
The Second EuroCPian Event will be in Brussels on the 4th of September
Can't manage to P/Invoke that Win32 API in .NET? Why not do interop the wiki way!
My Blog
|
|
|
|
|
Thanks, and I now fully understand the importance of encryption. Could you introduce some way to encrypt data in C#? And I am still confused about the place to store the password. Where do you think is a suitalbe location?
Thank you
vigorous
|
|
|
|
|
If you're asking such an over-simplified architectual question, I'd have to say it seems like you don't know where to begin - not a good sign if you think you can write your own security system. It's not easy and is often too over-simplified.
There are already mechanisms in place for this, such as using encrypted requests to a SQL Server 2000 database (or MSDE) where the passwords are hashed - NEVER store the passwords in plaintext.
If you want to protect a local, non-connected application, there is already facilities in Windows. Take a look at the article, How to Create a DPAPI Library[^], in the Microsoft Patterns and Practices section for one pretty secure method. This encapsulates DPAPI - a native API - in a .NET assembly that you can use with any managed language (C#, VB.NET, MC++, Perl.NET, etc.).
There are other ways, but you should study what exists by browing and searching MSDN[^], especially their Patterns and Practices[^] section which covers design, development, and deployment concepts including security in your application.
Security is definitely not something to take lightly.
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
In fact ,what I need is quite simple, Just an identity window which user can enter a username and password. If they are correct, user could enter the following interface. Just so simple. And there is a non-connected application.
Now I understand DPAPI could protect the password and database.But what I really care is where to store the username and password. Because in my application, even the password is not encrypted, it is alos ok. And I don't hope to use a seperate file to do that
Please give me a correct direction
Thank you
vigorous
|
|
|
|
|
DPAPI also stores the credentials securely. If you just hard-code a username and password in your code, it's easy for users to see it. I, for example, spend a lot of time looking at the assembly and type metadata, as well as the IL in assemblies to gain completely understanding how they work. I would see the strings you use for usernames and passwords.
Again, security should not be taken lightly. DPAPI provides what you need and even includes it's own prompt. Take a look at the article I linked which explains it all.
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
Is there any .net class I can use to obtain a boolean value given a string that represents an expression (a boolean expression)?????
|
|
|
|
|
Your looking to get an expression evaluated, contained in a String? There is nothing in the .NET BCL that does this. You'll have to come up with either a 3rd party component to do this for you, or you'll have to write an expression evaluation library yourself.
There is an example of this on CodeProject, but since there is a link problem going to CodeProject's site, I can't search for it in a reasonable amount of time. Just search the articles for "expression parse".
RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome
|
|
|
|
|
Thanks a lot.
I was hoping there could be a class
|
|
|
|
|
Like all primitives, Boolean has a Parse method for that very reason. You can also use Convert.ToBoolean (which uses Parse, but provides a little more abstract access to passing any primitive type (and a few other value types) to ToBoolean (though, in that case, few actually can be parsed into a bool).
[EDIT] Oops, I didn't read that quite right. Nevermind; though this is still handy information if you didn't know it already. [/EDIT]
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
There are a couple ways you could do this, including one way in the BCL (though not easy).
The first is to reference the Microsoft.JScript.dll assembly and use the Eval class. In JScript .NET, this would be equivalent of the eval method (also in Javascript and JScript, though those aren't compiled languages nor do they target the CLR). I believe I saw an article on this some time back on MSDN. I could be wrong, but you could try searching for it or just give it a try.
The other way is to use Reflection Emit or the CodeDOM. Basically, you create a class that contains those variables and contains a method which evaluates those variables and returns a bool.
Read Emitting Dynamic Assemblies[^] in the .NET Framework SDK for more information about Reflection Emit and Generating and Compiling Source Code Dynamically in Multiple Languages[^] for more information on CodeDOM.
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
Heath Stewart wrote:
The other way is to use Reflection Emit or the CodeDOM. Basically, you create a class that contains those variables and contains a method which evaluates those variables and returns a bool.
 All that for "?1+1=2". Seems kind of like having a nuclear power plant to power your USB notebook fan. I'd rather smash my head into a board of nails than go through that!
RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome
|
|
|
|
|
narada108,
There is no class in .net to do what you would like. However, depending on the format of your Boolean expression this may not be a difficult task. This task can be broken down into two easier problems. Convert the expression to a postfix expression, and then evaluate the postfix expression.
Typically a Boolean expression looks like this "1 and 1". This is called infix notation since the operator is between the operands. The postfix equivalent to this expression would be "1 1 and". In postfix notation the operator comes after the operands. A more complicated example follows:
infix: "1 and 1 and not 0 or 0"
postfix: "1 1 0 not and and 0 or"
It looks difficult but you get used to it really fast. The main advantage of writing the expressions this way is that they are easy to evaluate. How to evaluate a postfix expression is covered in many introductory computer science classes. The following code will evaluate an expression in this format.
<br />
private bool EvaluatePostfixExpression(string expression)<br />
{<br />
string[] pieces = expression.Split(new char[]{' '},100);<br />
<br />
System.Collections.Stack stack = new Stack();<br />
<br />
foreach(string cur in pieces)<br />
{<br />
if (cur == "0")<br />
stack.Push(false);<br />
else if (cur == "1")<br />
stack.Push(true);<br />
else if (cur == "and")<br />
{<br />
bool second = (bool)stack.Pop();<br />
bool first = (bool)stack.Pop();<br />
stack.Push(first && second);<br />
}<br />
else if (cur == "or")<br />
{<br />
bool second = (bool)stack.Pop();<br />
bool first = (bool)stack.Pop();<br />
stack.Push(first || second);<br />
}<br />
else if (cur == "not")<br />
{<br />
stack.Push(!(bool)stack.Pop());<br />
}<br />
<br />
}<br />
<br />
return (bool)stack.Pop();<br />
<br />
}<br />
For example EvaluatePostfixExpression("1 1 0 not and and 0 or") will return true;
I would recommend trying to get your Boolean expressions in postfix notation. If you can't then another simple stack based algorithm can be used to convert infix notation to postfix notation. I don't feel like writing that algorithm at the moment, so let me know if you go this way and need help with it. You can probably find these algorithms in a book on data structures.
Karl Baum
CEO of KGB Technologies
Specializing in custom software development.
|
|
|
|
|
|
Hi Everyone, this is my first time here and wonder if anyone out there can help me. I'm using VS.net 2003, and trying to display an "Open Dialog Box" on form MyForm.aspx. On MyForm.aspx, there is one button called "Browse", what i would like is that when the user click on the "Browse" button, the open dialog box pops up and allow user to select a *.csv file from any directory user choose to. It's like upload a file up on the sql server. If anyone have an example or give me a tour through the codes would be great, b/c I have never done anything like this before. Many thanx 
*HyVong*
|
|
|
|
|
There already is a component to do this. Read the documentation for the OpenFileDialog component in the .NET Framework SDK. While designing your form or user control in VS.NET, you can drag and drop this component from the "Components" section in your toolbox (where all the controls and components can be found when designing your controls).
You should really skim through the class library documentation and learn what's available. There are many controls and components to help you create rich apps but you'll only find them if you look.
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
Thank you very much, though i did go through the help search but i don't have much experience in the field as a student, that's why i'm seeking for help. Thank you.
*HyVong*
|
|
|
|
|
HyVong wrote:
but i don't have much experience in the field as a student
Sorry, but that's really a poor excuse. I was studying C/C++, COM, Perl, and HTML/DHTML long before I even went to college, and learned a lot while I was in college (just not at). College (or whatever educational system you're in) won't teach you everything you need to know. The sooner you realize that, the better off in the future you'll be. Don't wait - study all you can and in-depth so that you gain a good understanding, not just knowledge of what you're told. 
Things change constantly in this field and you have to keep up or get left behing. You do that through research and development and in-depth studies. That's what makes a good developer. Anyone can be taught to write code.
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
thank you, but if i'm that smart i wouldn't write this message today
I'm learning as i'm doing it, hopefully i'll get this project works. thanks again.
*HyVong*
|
|
|
|
|
b/c i'm using asp.net, it doesn't work the way i thought , so i had to use javascript instead, now i have to figure out how to upload the file on the server and put that file onto the dataset....any suggestion anyone?
*HyVong*
|
|
|
|
|
i want to use a query builer in my project, as well as SQL Server query analyser.
tahnks.
|
|
|
|
|
Could somebody give me a hint where I can find some documentation and advice how to handle MS Project 2003 data through programming with .NET and C#
Thanks
|
|
|
|
|
The best place to find the programming information about Office products is in the developer help that can be installed (and is installed if you choose a "Complete" install) with Office. MSDN[^] contains only the object model diagram (no clicketies) and conceptual articles (still good to read, though).
Even though the object model discusses VBA, the same is available in managed languages. VBA depends upon typelibs to provide OLE/COM automation interfaces and related types. This is the same information that VS.NET and the tlbimp.exe utility use to create a Runtime Callable Wrapper (RCW, often called an "interop assembly"). If you have Office XP, you can download the official interop assemblies (Primary Interop Assemblies, or PIAs) from http://www.microsoft.com/downloads/details.aspx?FamilyId=C41BD61E-3060-4F71-A6B4-01FEBA508E52&displaylang=en[^]. If you have Office 2003 Professional, these can be installed along with Office (Microsoft .NET Programming Support).
If you want to support older Office versions, use tlbimp.exe (and specify signing options, which is important if you want to install into the GAC) to generate interop assemblies from those products. These will typically work with newer versions of Office products as well since the typelibs are versioned and class interfaces are almost always backward compatible (at least for the basics).
So, just remember that whatever you read about the object model for VB/VBA, it will work in managed code as well using interop assemblies (though sometimes a little extra programming is required...sometimes).
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
