![]() | |
![]() |
| | Thread Tools | Display Modes |
#21
| |||
| |||
|
|
I don't know what a file-based database engine is. In the old days of FoxPro, where the tables were external, I can understand. A self contained unit like Access, don't know. |
|
OK. Still, if you have one method that is insecure and another method to make it secure, one should go to the second method. Perhaps MS is pushing Sharepoint. |
#22
| |||
| |||
|
|
Perhaps MS is pushing Sharepoint. |
#23
| |||
| |||
|
|
1. Ask my user for a password. 2. Hash it quickly & discard the plaintext. 3. Select a salt. 4. Combine Salt & hash in some manner then re-hash. (I used SHA-256) 5. Send #4 in as the actual password granting them access to the backend. This way, I never need to save the password in the file, the user supply the piece but doesn't actually know the real password that was sent to the server. Salt are, for lack of better term, "deterministically randomly selected" so while they could read the salts in the MDE, they wouldn't know which salts was actually used, and even so, they don't actually know what algorithm I used to combine the salt & hash (which is also "deterministically randomly" selected as well) and MDE has compiled up the algorithms so they'll need to pull out a decompiler. Once authenticated, it was all up to the backend server's security mechanism to grant them the necessary permissions to the data as they work in the application. |
#24
| |||
| |||
|
|
I think it would be relatively trivial to decompile an MDE that isn't encrypted (and password-protected) to figure out what your encryption code actually does. |
![]() |
| Thread Tools | |
| Display Modes | |
| |