Your Comments.

• # re: No more excuses – encrypt your web.config

  If someone gains access to Web.config isn't it game over anyway?

  Left by Duncan Smart at 7/16/2009 8:26 PM
• # re: No more excuses – encrypt your web.config

  Well they shouldn't in the first place, however badly written pages may well leave room to get it.
  
  It depends, if you have a publicly accessible SQL server and are using SQL authentication (i.e. pretty much every shared hosting environment) then, if you are given the ability, you should encrypt. Mind you I've not seen any shared hosters that all this.
  
  But if you're storing anything sensitive in there then you should, even in corporate environments - why should a server admin suddenly gain the ability to connect to a SQL database

  Left by barryd at 7/16/2009 8:32 PM
• # re: No more excuses – encrypt your web.config

  It's actually rather interesting what happens when you encrypt the web.config file.
  
  Deep within the All Users folder is a storage place for all of the keys. All users except the 'Administrators' group are denied access to the key files (as in can't even read them). The access to this key is depends on the access level of the worker process in your site which means it needs to have read access of the key or be an administrator.
  
  If someone finds a way to download your web.config file then they still need to find a way to get a hold of that file which is technically more difficult than getting an unencrypted web.config -- :)
  
  I know there are some further options available to encrypt it with even more security, but for now I just put the defaults on the program.
  
  Thanks for linking my utility - And the goatee doesn't make me _that_ evil, but since I didn't figure I would be trusted I went ahead and included the source code as well -- :)
  

  Left by webdev_hb at 7/17/2009 12:33 AM

Your Reply.

Comment Form.

Fields denoted with a "*" are required.

*Your name:

*Subject:

You may also like to leave your email or website.

Your blog:

Your email:  (will not be displayed)

*Your message:
 

Please add 3 and 2 and type the answer here:

Enter the code shown above:

Preview Your Comment.