143 reputation
5
bio website alphatron.co.uk
location United Kingdom
age 41
visits member for 2 years, 11 months
seen Jun 17 at 14:04

Dev bloke using the usual technologies - C#, ASP.Net, ASP classic, VB.Net, VB6, PHP, MySQL, Javascript, etc. Now moving into Java and Play!, Salesforce, PostgreSQL and other odds and ends


Nov
28
comment Where do I securely store the key for a system where the source is visible?
To quote the original question "this machine is NOT Internet connected", so PayPal et al. isn't gonna help here
Aug
23
comment Where do I securely store the key for a system where the source is visible?
@ewanm89 - the rules are (mostly) aimed at systems where they can't see the source to see where I'm storing the keys, what algorithm I'm using, etc. Reading the source, they can find the part of my code that handles the decryption
Aug
8
comment Where do I securely store the key for a system where the source is visible?
You can encrypt the Access database, requiring a password to even open it....but the one in question won't encrypt due to some guff about too many Table IDs
Aug
8
awarded  Scholar
Aug
8
accepted Where do I securely store the key for a system where the source is visible?
Aug
8
comment Where do I securely store the key for a system where the source is visible?
Josh - they're non IT admin staff.The system handles bookings for mailbox rentals, with automatic renewals if they don't explicitly cancel, hence the need to have the CC details to process the renewal transactions. Not sure what else you'd need to know
Aug
7
comment Where do I securely store the key for a system where the source is visible?
Couple of good points here - physical access is a tough one given the physical location of the machines in a public area, but I'm liking the staff USB key approach. Might research that further. There's only 1 staff member per premise (2 shops in different parts of town), so user access levels is kind of moot
Aug
7
comment Where do I securely store the key for a system where the source is visible?
"You could look at PCI-DSS compliance" - yeah, I don't think they're ready for full on compliance, but as an IT professional, I'd be remiss if I returned the database back to them still holding CC numbers in plaintext, hence giving them something a little more robust
Aug
7
awarded  Editor
Aug
7
revised Where do I securely store the key for a system where the source is visible?
More info and/or clarification
Aug
6
awarded  Student
Aug
6
comment Where do I securely store the key for a system where the source is visible?
Some good points there - I was thinking rather than the registry with ACL controls, I'd use the DPAPI, but even that's susceptible now (www.dpapick.com)
Aug
6
asked Where do I securely store the key for a system where the source is visible?
Aug
4
awarded  Supporter
Aug
4
awarded  Autobiographer