Secure data transmission from ASP.NET pages

Hi,

I would like to build a page to capture some sensitive information that shouldnt end up in the hands on wrong people (:-))

I will be also provide login facilities for people entering these info on the page.

How can i secure both the login details and sensitive data

Is there any encryption and stuff available for ASP.Net

Thanks

justin_smithAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

WikkardCommented:
All you need to do is use SSL on the web server.

This will secure the connection from the user to the server.

After that if you think the security on your server may be an issue you can store the data gathered in an encrypted format.
.net does have excellent support for crytography built in.
0
CDirenziCommented:
0
WikkardCommented:
Normally user passwords would be encrypted using a one way hashing function.  You store this encrypted version of the user password in your database, then when a user login occurs you simply hash the input password and compare the result with the hashed password which you have stored. This way the users password is never exposed.

This site has some good info on the .net cryptography namespace which should get you started.
http://www.codeproject.com/KB/security/Cryptography_NET.aspx

If you are using SQL Server 2005 or later you may want to consider using the built in crypto features it can provide on specific columns or tables.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Cloud Class® Course: Microsoft Office 2010

This course will introduce you to the interfaces and features of Microsoft Office 2010 Word, Excel, PowerPoint, Outlook, and Access. You will learn about the features that are shared between all products in the Office suite, as well as the new features that are product specific.

justin_smithAuthor Commented:
Thanks everyone....

most of the crypto stuff give me a shield between the web server and the database..

i may be wrong here.. if i use just HTTP the username and password will be cleartext.

When you say SSL, i have to use HTTPS.. is it ok even if dont posses a valid digital certificate?
0
CDirenziCommented:
Yes you will need to use HTTPS
0
justin_smithAuthor Commented:
ok.. the security side functionality will still work even if i use HTTPS without a valid certificate
0
WikkardCommented:
Yes it will however the users browser will complain that the certificates aren't valid.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
ASP.NET

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.