Solved

Secure data transmission from ASP.NET pages

Posted on 2008-10-19
7
435 Views
Last Modified: 2012-05-05
Hi,

I would like to build a page to capture some sensitive information that shouldnt end up in the hands on wrong people (:-))

I will be also provide login facilities for people entering these info on the page.

How can i secure both the login details and sensitive data

Is there any encryption and stuff available for ASP.Net

Thanks

0
Comment
Question by:justin_smith
  • 3
  • 2
  • 2
7 Comments
 
LVL 8

Expert Comment

by:Wikkard
ID: 22755069
All you need to do is use SSL on the web server.

This will secure the connection from the user to the server.

After that if you think the security on your server may be an issue you can store the data gathered in an encrypted format.
.net does have excellent support for crytography built in.
0
 
LVL 4

Expert Comment

by:CDirenzi
ID: 22755080
0
 
LVL 8

Accepted Solution

by:
Wikkard earned 500 total points
ID: 22755100
Normally user passwords would be encrypted using a one way hashing function.  You store this encrypted version of the user password in your database, then when a user login occurs you simply hash the input password and compare the result with the hashed password which you have stored. This way the users password is never exposed.

This site has some good info on the .net cryptography namespace which should get you started.
http://www.codeproject.com/KB/security/Cryptography_NET.aspx

If you are using SQL Server 2005 or later you may want to consider using the built in crypto features it can provide on specific columns or tables.
0
Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

 

Author Comment

by:justin_smith
ID: 22755205
Thanks everyone....

most of the crypto stuff give me a shield between the web server and the database..

i may be wrong here.. if i use just HTTP the username and password will be cleartext.

When you say SSL, i have to use HTTPS.. is it ok even if dont posses a valid digital certificate?
0
 
LVL 4

Expert Comment

by:CDirenzi
ID: 22755213
Yes you will need to use HTTPS
0
 

Author Comment

by:justin_smith
ID: 22755219
ok.. the security side functionality will still work even if i use HTTPS without a valid certificate
0
 
LVL 8

Assisted Solution

by:Wikkard
Wikkard earned 500 total points
ID: 22755461
Yes it will however the users browser will complain that the certificates aren't valid.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

I have developed many web applications with asp & asp.net and to add and use a dropdownlist was always a very simple task, but with the new asp.net, setting the value is a bit tricky and its not similar to the old traditional method. So in this a…
User art_snob (http://www.experts-exchange.com/M_6114203.html) encountered strange behavior of Android Web browser on his Mobile Web site. It took a while to find the true cause. It happens so, that the Android Web browser (at least up to OS ver. 2.…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…
This is a video that shows how the OnPage alerts system integrates into ConnectWise, how a trigger is set, how a page is sent via the trigger, and how the SENT, DELIVERED, READ & REPLIED receipts get entered into the internal tab of the ConnectWise …

939 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question