Encrypting app settings file is secure than encrypting only the app setting contents?

Question

I have a content as shown below

I have encrypted the content by running the below command

cd C:\Windows\Microsoft.NET\Framework\v4.0.30319 aspnet_regiis.exe -pef "secureAppSettings" "your application web config path" -prov >> "DataProtectionConfigurationProvider"

This generated as follow (Sample , not the real password :) )

But our app settings is going in all devices and accessible to users. How safe is it? they can still copy it. So what is the solution? do I need to encrypt the app setting file itself?

Answer 1

Encrypting the complete file or encrypting only the entry will provide the same level of security regarding this entry. There is no practical difference, they offer the same protection against the same threat.

Side note: Please note however that if an end user can reverse-engineer your application or read its memory, this user can discover the encryption key and recover the encrypted password. So, while encrypting can provide some amount of security against common users, it is not enough to resist a motivated attacker with an access to the running application. But maybe those attackers do not exist in your threat model, but then in this case maybe encrypting this entry is pointless and proper access control would be enough. Only you can answer those questions.