Suppose we are in the field of desktop applications which need to store their data in a database. How do I store the password for this database avoiding the most obvious mistakes, which are:

1. hard coding the database password inside the code (cited as #21 coding horror under „Hard-coded passwords“ inside http://www.codinghorror.com/blog/2009/01/top-25-most-dangerous-programming-mistakes.html)
2. encrypting the password of the database and storing it in a file, you would shift the problem to: „where do I store the password which encrypts the database's password?“
3. using a remote database server and an n-tier architecture where the program doesn't directly access the database but authenticates with another layer which grants each operation and forwards it to the database layer. Everything is encrypted through ssl and authentication is done via a digital certificate (so effectively using public key cryptography).

Number 3 is actually a solution but it doesn't apply to desktop applications which need to work offline!

Someone on another similar question answered that to „give untrusted users trusted access to a system“ is unfeasible that's why DRM never worked, however he didn't cite a proved study or a proved theorem.

Notice the same problem happens if we want to encrypt the database: where do I store the password with which I encrypt a database in a desktop application?

Can anybody shed some insight? Thank you

NOTE: this same problem is discussed in CWE-259: Use of Hard-coded Password but no definitive solution is explained

Suppose we are in the field of desktop applications which need to store their data in a database. How do I store the password for this database avoiding the most obvious mistakes, which are:

1. hard coding the database password inside the code (cited as #21 coding horror under „Hard-coded passwords“ inside http://www.codinghorror.com/blog/2009/01/top-25-most-dangerous-programming-mistakes.html)

2. encrypting the password of the database and storing it in a file, you would shift the problem to: „where do I store the password which encrypts the database's password?“

3. using a remote database server and an n-tier architecture where the program doesn't directly access the database but authenticates with another layer which grants each operation and forwards it to the database layer. Everything is encrypted through ssl and authentication is done via a digital certificate (so effectively using public key cryptography).

Number 3 is actually a solution but it doesn't apply to desktop applications which need to work offline!

Someone on another similar question answered that to „give untrusted users trusted access to a system“ is unfeasible that's why DRM never worked, however he didn't cite a proved study or a proved theorem.

Notice the same problem happens if we want to encrypt the database: where do I store the password with which I encrypt a database in a desktop application?

Can anybody shed some insight? Thank you

NOTE: this same problem is discussed in CWE-259: Use of Hard-coded Password but no definitive solution is explained