{"id":416,"date":"2011-11-01T10:34:45","date_gmt":"2011-11-01T16:34:45","guid":{"rendered":"https:\/\/chrisedwards.dreamhosters.com\/blog\/?p=416"},"modified":"2011-10-31T23:24:35","modified_gmt":"2011-11-01T05:24:35","slug":"you-are-protecting-your-passwords-in-your-config-files-arent-you","status":"publish","type":"post","link":"http:\/\/architester.com\/blog\/2011\/11\/01\/you-are-protecting-your-passwords-in-your-config-files-arent-you\/","title":{"rendered":"You ARE protecting your passwords in your config files AREN’T YOU?"},"content":{"rendered":"

When we are writing software for our clients, we have a fiduciary<\/a> responsibility to ensure the security of their site.<\/p>\n

One way to increase security is to ensure that passwords and other sensitive information are not laying around in our config files unsecured (in plain text). All too many times I have seen something like the following in a config file:<\/p>\n

Code Sample:<\/p>\n

<?xml<\/span> version<\/span>="<\/span>1.0<\/span>"<\/span> encoding<\/span>="<\/span>utf-8<\/span>"<\/span> ?>\r\n<configuration<\/span>>\r\n    <appSettings<\/span>>\r\n        <add<\/span> key<\/span>="<\/span>UserName<\/span>"<\/span> value<\/span>="<\/span>PresidentSkroob<\/span>"<\/span> \/>\r\n        <add<\/span> key<\/span>="<\/span>Password<\/span>"<\/span> value<\/span>="<\/span>12345<\/span>"<\/span> \/>\r\n    <\/appSettings<\/span>>\r\n<\/configuration<\/span>><\/pre>\n
Fixing this problem is as easy as using Microsoft’s Data Protection API. Just encrypt the value by calling ProtectedData.Protect()<\/code>. And to decrypt the value, call ProtectedData.Unprotect()<\/code>. <\/p>\n
Both methods take an entropy value (salt), and a DataProtectionScope<\/code> value that defines the scope for which the value should be encrypted. The scope may be one of the following: CurrentUser<\/code> – Only the current user can decrypt the value, or LocalMachine<\/code> – The value can only be decrypted on the local machine. CurrentUser<\/code> can be a little complicated since it may require you to impersonate users in certain cases, so I just use LocalMachine<\/code>. This does mean that you can’t ship the config file with the values pre-encrypted because they will not be decryptable on the machine its installed on (it can only be decrypted by the machine that encrypted it). <\/p>\n
The functions return a byte array, so I Base64 encode the values prior to writing them to the config file. To do this, I wrote a few extension methods. Here they are:<\/p>\n
Encryption:<\/p>\n
\/\/\/<\/span> <\/span><summary><\/span>\r\n\/\/\/<\/span> Converts a string to a protected value (encrypted using Data Protection API)<\/span>\r\n\/\/\/<\/span> <\/span><\/summary><\/span>\r\n\/\/\/<\/span> <\/span><param name=<\/span>"value"<\/span>><\/span>The value.<\/span><\/param><\/span>\r\n\/\/\/<\/span> <\/span><param name=<\/span>"entropy"<\/span>><\/span>The entropy.<\/span><\/param><\/span>\r\n\/\/\/<\/span> <\/span><returns><\/returns><\/span>\r\npublic<\/span> static<\/span> string<\/span> ToProtectedValue<\/span>( this<\/span> string<\/span> value<\/span>, string<\/span> entropy<\/span> )\r\n{\r\n    var<\/span> entropyBytes<\/span> =<\/span> Encoding.<\/span>UTF8<\/span>.<\/span>GetBytes<\/span>( entropy<\/span> );\r\n    var<\/span> valueBytes<\/span> =<\/span> Encoding.<\/span>UTF8<\/span>.<\/span>GetBytes<\/span>( value<\/span> );\r\n \r\n    var<\/span> securedBytes<\/span> =<\/span> ProtectedData<\/span>.<\/span>Protect<\/span>( valueBytes<\/span>,\r\n                                              entropyBytes<\/span>,\r\n                                              DataProtectionScope<\/span>.<\/span>LocalMachine<\/span> );\r\n    \r\n    return<\/span> securedBytes<\/span>.<\/span>AsBase64<\/span>();\r\n}<\/pre>\n
Decryption:<\/p>\n
\/\/\/<\/span> <\/span><summary><\/span>\r\n\/\/\/<\/span> Converts a string to a protected value (encrypted using Data Protection API)<\/span>\r\n\/\/\/<\/span> <\/span><\/summary><\/span>\r\n\/\/\/<\/span> <\/span><param name=<\/span>"protectedString"<\/span>><\/param><\/span>\r\n\/\/\/<\/span> <\/span><param name=<\/span>"entropy"<\/span>><\/span>The entropy.<\/span><\/param><\/span>\r\n\/\/\/<\/span> <\/span><returns><\/returns><\/span>\r\npublic<\/span> static<\/span> string<\/span> ToUnprotectedString<\/span>( this<\/span> string<\/span> protectedString<\/span>, string<\/span> entropy<\/span> )\r\n{\r\n    var<\/span> entropyBytes<\/span> =<\/span> Encoding.<\/span>UTF8<\/span>.<\/span>GetBytes<\/span>( entropy<\/span> );\r\n    var<\/span> encryptedBytes<\/span> =<\/span> Convert<\/span>.<\/span>FromBase64String<\/span>( protectedString<\/span> );\r\n    \r\n    var<\/span> decryptedBytes<\/span> =<\/span> ProtectedData<\/span>.<\/span>Unprotect<\/span>( encryptedBytes<\/span>,\r\n                                                  entropyBytes<\/span>,\r\n                                                  DataProtectionScope<\/span>.<\/span>LocalMachine<\/span> );\r\n    \r\n    return<\/span> Encoding.<\/span>UTF8<\/span>.<\/span>GetString<\/span>( decryptedBytes<\/span> );\r\n}<\/pre>\n
After encrypting these values appropriately, your config file will look like this:<\/p>\n
<?xml<\/span> version<\/span>="<\/span>1.0<\/span>"<\/span> encoding<\/span>="<\/span>utf-8<\/span>"<\/span> ?>\r\n<configuration<\/span>>\r\n    <appSettings<\/span>>\r\n        <add<\/span> key<\/span>="<\/span>UserName<\/span>"<\/span> value<\/span>="<\/span>ADZgAAwAAAABAAAACLYg+TEHoFh88HcfvNTg0yAAAAAASAAACgAAAAEAAAAMFLpAQAAANCMnd8BFdERjHoAwE\/Cl+sBAAAA8BdWygYhjUWaw3teJQo04AQAAAACAAAAAAXFMCeBnOURIBAl2DJoQAAAAN7+sLiIZl+x9vPjC16wcmRQAAADS4d9bdlcLF9CmKrsbgGWPM29zAQ==<\/span>"<\/span> \/>\r\n        <add<\/span> key<\/span>="<\/span>Password<\/span>"<\/span> value<\/span>="<\/span>AQAAANCMnd8BFdERjHoAwE\/Cl+sBAAAA8BdWygYhjUWaw3teJQo04AQAAAACAAAAAAADZgAAwAAAABAAAAAhfu4ghotvmXphmGWOHFfbAAAAAASAAACgAAAAEAAAAMBMv0D9\/mDwktrFSVNIPcwQAAAAwg2IDL1+MOHwdx2A1cax2RQAAACZLB62COjpupN2+pW4yT8LKR5Udg==<\/span>"<\/span> \/>\r\n    <\/appSettings<\/span>>\r\n<\/configuration<\/span>><\/pre>\n
Now you and your clients can sleep a little better at night knowing their sensitive information is just a bit more secure. <\/p>\n","protected":false},"excerpt":{"rendered":"
When we are writing software for our clients, we have a fiduciary responsibility to ensure the security of their site. One way to increase security is to ensure that passwords and other sensitive information are not laying around in our config files unsecured (in plain text). All too many times I have seen something like […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27,31,48,55],"tags":[79,93,30,100],"class_list":["post-416","post","type-post","status-publish","format-standard","hentry","category-net","category-c","category-configuration","category-security","tag-net","tag-configuration","tag-csharp","tag-security"],"aioseo_notices":[],"_links":{"self":[{"href":"http:\/\/architester.com\/blog\/wp-json\/wp\/v2\/posts\/416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/architester.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/architester.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/architester.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/architester.com\/blog\/wp-json\/wp\/v2\/comments?post=416"}],"version-history":[{"count":12,"href":"http:\/\/architester.com\/blog\/wp-json\/wp\/v2\/posts\/416\/revisions"}],"predecessor-version":[{"id":431,"href":"http:\/\/architester.com\/blog\/wp-json\/wp\/v2\/posts\/416\/revisions\/431"}],"wp:attachment":[{"href":"http:\/\/architester.com\/blog\/wp-json\/wp\/v2\/media?parent=416"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/architester.com\/blog\/wp-json\/wp\/v2\/categories?post=416"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/architester.com\/blog\/wp-json\/wp\/v2\/tags?post=416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}