Solved

Secure data transmission from ASP.NET pages

Posted on 2008-10-19
7
452 Views
Last Modified: 2012-05-05
Hi,

I would like to build a page to capture some sensitive information that shouldnt end up in the hands on wrong people (:-))

I will be also provide login facilities for people entering these info on the page.

How can i secure both the login details and sensitive data

Is there any encryption and stuff available for ASP.Net

Thanks

0
Comment
Question by:justin_smith
  • 3
  • 2
  • 2
7 Comments
 
LVL 8

Expert Comment

by:Wikkard
ID: 22755069
All you need to do is use SSL on the web server.

This will secure the connection from the user to the server.

After that if you think the security on your server may be an issue you can store the data gathered in an encrypted format.
.net does have excellent support for crytography built in.
0
 
LVL 4

Expert Comment

by:CDirenzi
ID: 22755080
0
 
LVL 8

Accepted Solution

by:
Wikkard earned 500 total points
ID: 22755100
Normally user passwords would be encrypted using a one way hashing function.  You store this encrypted version of the user password in your database, then when a user login occurs you simply hash the input password and compare the result with the hashed password which you have stored. This way the users password is never exposed.

This site has some good info on the .net cryptography namespace which should get you started.
http://www.codeproject.com/KB/security/Cryptography_NET.aspx

If you are using SQL Server 2005 or later you may want to consider using the built in crypto features it can provide on specific columns or tables.
0
Free Tool: Postgres Monitoring System

A PHP and Perl based system to collect and display usage statistics from PostgreSQL databases.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 

Author Comment

by:justin_smith
ID: 22755205
Thanks everyone....

most of the crypto stuff give me a shield between the web server and the database..

i may be wrong here.. if i use just HTTP the username and password will be cleartext.

When you say SSL, i have to use HTTPS.. is it ok even if dont posses a valid digital certificate?
0
 
LVL 4

Expert Comment

by:CDirenzi
ID: 22755213
Yes you will need to use HTTPS
0
 

Author Comment

by:justin_smith
ID: 22755219
ok.. the security side functionality will still work even if i use HTTPS without a valid certificate
0
 
LVL 8

Assisted Solution

by:Wikkard
Wikkard earned 500 total points
ID: 22755461
Yes it will however the users browser will complain that the certificates aren't valid.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Problem Hi all,    While many today have fast Internet connection, there are many still who do not, or are connecting through devices with a slower connect, so light web pages and fast load times are still popular.    If your ASP.NET page …
It was really hard time for me to get the understanding of Delegates in C#. I went through many websites and articles but I found them very clumsy. After going through those sites, I noted down the points in a easy way so here I am sharing that unde…
I've attached the XLSM Excel spreadsheet I used in the video and also text files containing the macros used below. https://filedb.experts-exchange.com/incoming/2017/03_w12/1151775/Permutations.txt https://filedb.experts-exchange.com/incoming/201…

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question