security of hard-wired passwords
lazarus / 16-Databases

----------------------------------------------------------------------
mbohn · 2010-04-19 13:10

OSX 10.6.3
fpc 2.4.0
console app (not using ide)
MySQL 5.1.45 (on client)
MySQL 5.1.44 (on server)

There are dozens of posts in this forum with the following sample
code:

xyz.password:=' pppp ';

I have a client app with a need to use a hardwired password in the FPC
code and I'm wondering what the security implications are of this
move.

The compiled fpc code will be placed on my server so I assume if
someone could access the account the code is saved under, they can see
the password within the executable since it is stored there in clear
text. 

Do I have any other options?

A review of the MySQL docs was not helpful.

----------------------------------------------------------------------
Leledumbo · 2010-04-20 04:21

Don't save the password, instead its hash value (MD5 or SHA1 or
whatever algorithm). The drawback is that when you forgot the
password, it means goodbye to the account.

----------------------------------------------------------------------
Lacak2 · 2010-04-21 03:37

IMHO the problem is in it, that when you connect to MySQL Server you
MUST provide password in clear-text for mysql_real_connect() API
function. Then password is "encrypted" and send to server for
authentication.
So if password is not supplied by user, it must be stored somewhere.
It may be encrypted, but ONLY reversible encryption algorithm.
So hashing is not a solution.
As a very simple solution you can use some kind of XOR operation ...

----------------------------------------------------------------------
Leledumbo · 2010-04-21 04:30

QuoteSo hashing is not a solution.I really mean to store the password
hash value as the login password. We can then connect to the server
though:
Code: [Select]xyz.password:=HashPassword('password');

----------------------------------------------------------------------
mbohn · 2010-04-22 11:01

QuoteCode: [Select]xyz.password:=HashPassword('password');
But then 'password' still appears as plaintext in your executable.

----------------------------------------------------------------------
Leledumbo · 2010-04-23 05:18

OK, create a small program for encrypting the password. Encrypt the
password and hardcode the result in your program. Create the decryptor
in your program and call it instead. Like:
Code: [Select]xyz.password:=DecryptPassword('EncryptedPassword');

----------------------------------------------------------------------
mbohn · 2010-04-23 13:25

Thanks!  That makes sense.