Timeline for How to effectively save database password inside desktop application?
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 2, 2013 at 15:18 | comment | added | dendini | Also communicating securely over a public channel without having to agree upon a shared key beforehand seems a chicken and egg problem to me, however we know public key cryptography makes it possible. My point is you might be right but it's strange to me there's no theorem or well known paper on the subject. | |
| May 2, 2013 at 15:11 | comment | added | user10211 | @dendini Your scenario IS a chicken or egg problem. Hardcoding the password into the application binary is not an option. Simple reverse engineering will reveal the password, even if you try to obfuscate it. Storing it somewhere on the filesystem is not an option either, any attacker with access to the computer can simply pull the password from the system. And obviously storing it in the database is not an option.... | |
| May 2, 2013 at 15:02 | comment | added | dendini | The user must not know the password and must not be able to access the database directly, but must be able to use the database through the software. I like the chicken and egg reference but it doesn't really fit my situation or at least it must be proved. It sound however a lot like a rephrasing of the impossibility to „give untrusted users trusted access to a system“. | |
| May 2, 2013 at 14:55 | history | answered | user10211 | CC BY-SA 3.0 |