1

I am implementing a C++ server with a mariadb backend. I have to access my database and I do so using the mariadbpp (its c++ connector). Though I can use mysql_config_editor and store the passwords in an (encrypted) .cnf file, mariadbpp's API needs a password. This is how I am using it:

mariadb::account_ref acc = mariadb::account::create("localhost", "order", "<password>", "Orders");

The database is configured to only be accessible from localhost. Is putting the password in .cpp source file okay from security perspective?

3
  • 1
    Related: security.stackexchange.com/q/79717/165253
    – forest
    Feb 23, 2019 at 10:34
  • Note that storing the password in a const std::string at runtime is independent of hardcoding it in the program's source code. It's only the latter that's a bad idea. Feb 23, 2019 at 15:01
  • I am not sure I understand what you said @JosephSible . Do you mean storing the password in const std::string from a file, (at run time) is the same as hardcoding it. Just the latter is a really bad idea coz the hacker can analyze the binary and figure that out?
    – Hemil
    Feb 24, 2019 at 5:54

2 Answers 2

4

Hardcoding of secrets is never a good idea.

Use a configuration file, to read from. This way you will be able to swiftly change the password if required and prevent the password from leaking through version control or binary analysis.

3
  • Do you have any idea how to do that in Mariadbpp?
    – Hemil
    Feb 23, 2019 at 10:44
  • I'm not familiar with mariadbpp, and cannot tell whether it offers built-in functionality for this, but your C++ binary could easily parse a configuration file, store the password from there in a variable and later use the variable to connect to the database. Feb 23, 2019 at 10:58
  • Ya. Thats a good idea. How could I forget that
    – Hemil
    Feb 23, 2019 at 11:00
1

No, anyone can execute the "Strings.exe" program on a compiled program to reveal any hard coded strings.

1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Mar 25, 2023 at 11:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .