For Windows, I'd say that using DPAPI is the way to do, using the
IIS_USERxxx
or similar user's credentials to do the encryption.
Michael Howard...are you out there? Doesn't Microsoft recommend using
DPAPI
(which if I'm not mistaken is not part of the .NET 2.0 Framework)?
---
Kevin W. Wall Qwest Information Technology, Inc.
Kevin.Wall@qwest.com Phone: 614.215.4788
"The reason you have people breaking into your software all
over the place is because your software sucks..."
-- Former whitehouse cybersecurity advisor, Richard Clarke,
at eWeek Security Summit
-----Original Message-----
From: bugtraq@cgisecurity.net [mailto:bugtraq@cgisecurity.net]
Sent: Tuesday, May 16, 2006 10:30 AM
To: Gerald Quakenbush
Cc: John Madden; webappsec@securityfocus.com
Subject: Re: MYSQL and PHP
Windows provides a way in ASP.NET to store the user/pass encrypted in
the registry and simply referencing it in your web.config allows it to
automagically work. I'm curious what solutions for php exist to allow
encrypted storage of sql login credentials so we can avoid the whole
storage in cleartext on the filesystem?
- zeno
http://www.cgisecurity.com/ Web Security news, and More
http://www.cgisecurity.com/index.rss [RSS Feed]
------------------------------------------------------------------------
-
Sponsored by: Watchfire
Watchfire named worldwide market share leader in web application
security
assessment by leading market research firm. Watchfire's AppScan is the
industry's first and leading web application security testing suite, and
the only solution to provide comprehensive remediation tasks at every
level of the application. See for yourself.
Download a Free Trial of AppScan 6.0 today!
https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
------------------------------------------------------------------------
--
This communication is the property of Qwest and may contain confidential or
privileged information. Unauthorized use of this communication is strictly
prohibited and may be unlawful. If you have received this communication
in error, please immediately notify the sender by reply e-mail and destroy
all copies of the communication and any attachments.
-------------------------------------------------------------------------
Sponsored by: Watchfire
Watchfire named worldwide market share leader in web application security
assessment by leading market research firm. Watchfire's AppScan is the
industry's first and leading web application security testing suite, and
the only solution to provide comprehensive remediation tasks at every
level of the application. See for yourself.
Download a Free Trial of AppScan 6.0 today!
https://www.watchfire.com/securearea/appscansix.aspx?id=701300000007t9c
--------------------------------------------------------------------------
