I want to make a client-side, Windows-based application that allows the user to register and it will store the registration details in an online MySQL server.

However when i googled ways to do this, I found that to establish such a MySQL connection I should provide an SQL user with write permissions and also provide that SQL user’s password (All these should be in my code).

This leads to a problem; if someone decompiled my application, they could get my SQL user and password, and they could see and do anything to my SQL database.

Is there anyway to prevent this?

  • 1
    I would never leave a database exposed to the internet, period. – multithr3at3d Nov 25 '19 at 3:32

Yes and no.

First the no: As you have realized, if any data you put in an app that you send to a client can be extracted from it. You can take steps to make it harder to find the password (obfuscation, encryption, etc) but as a general rule of thumb, never put anything in the app that isn't supposed to be public.

So how do you protect your database password? Simple: don't store it in the app. Make a small web application that the app sends the registration details to, and then have the web application store things in the database. This way credentials never leave your control.

| improve this answer | |
  • 2
    Basically like an API or middleman that transfer your credentials in a encrypted and secure way. – Cash- Nov 25 '19 at 5:36

Whatever you write in your application code can be reversed and found by an attacker who has access to the binary and/or source code.

You can put the password in the database, or in a separate file, but at the end it just moves the same problem elsewhere.

Unfortunately there is only one proper way to do it, and it costs money: using a digital vault which stores the password securely. The application would use the permissions it runs with to access the vault.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.