I have a Windows service which connects to a database to poll some value in order to monitor certain activity.
Of course, to use this I need a database password. I need to keep this password safe, since it is of course not supposed to be common knowledge. In order to do this, I have developed a simple XOR cipher and stored the ciphertext in the config file. The key I have used for the cipher has for now been hardcoded into the service.
Of course, this hard coding is not ideal, since somebody can disassemble the .exe and see both the key and the cipher!
I am not expecting most people to be capable of doing this, but I feel it is best to mitigate risk where possible. So, is there perhaps a better approach to this problem?
I know it is always best to use an existing solution where possible, but I couldn't find anything specifically that would work in this case. I looked at the Windows Data Protection API, but from what I could tell that only worked within one instance of an application. It would not allow me to store the ciphertext in a file and access it later.