No worry about capturing DB password?
lazarus / 16-Databases

----------------------------------------------------------------------
egsuh · 2021-08-09 14:18

Hi,
I'm asking this question rather seriuosly, but not very seriously.

If I set up a Firebird (or any other database) and distribute the
compiled exefile with database, is there no possibility of re-compile
the .exe file and find out the user_id and password?

- If I distribute .ini file then it will be open to everybody.
- What if I enter user_id and password in the object inspector?
- What if I define them as constant or variable within FP codes?

----------------------------------------------------------------------
MarkMLl · 2021-08-09 15:02

Use a database plus client libraries which requires some form of
encrypted key/certificate file for access, or at the very least have a
user setup stage which hashes his password, tells the database to use
that as the user's password, and stores it locally.

Storing a password as plaintext is a very big "no-no", but ultimately
a great deal depends on the client access libraries and what they do
to (a) facilitate credentials storage in encrypted form and (b) ensure
that credentials are never sent across a network (or, in the general
case, between programs) in unecrypted form.

MarkMLl

----------------------------------------------------------------------
balazsszekely · 2021-08-09 15:19

@egsuh
Firebird assumes that the PC on which the servers runs is secure. With
that said, if somebody has your exe/db pretty much every
crypting/hashing/etc... technique is useless. Take a look at the
attached image. Left Ollydbg, right a dummy pascal code. The program
can be easily patched to show valid password even when you enter an
invalid one. Just change the blue JNE(Jump if not equal) to JE(Jump if
equal). I'm aware that the example is an oversimplification, however
with programs like CDA(function hooking) and dissasamblers like IDA
and OllyDbg shouldn't take to long to patch any exe.

----------------------------------------------------------------------
LacaK · 2021-08-10 11:10

Quote from: egsuh on August 09, 2021, 04:18:03 pm- What if I enter
user_id and password in the object inspector?
- What if I define them as constant or variable within FP codes?
As GetMem wrote both these techniques are vulnerable to attack (if
user/password is part of the form then it is also included in exe file
in clear text form).
What I do is that, I store password in encoded (not encrypted) form
and is decoded during logon in procedure in application.
It is sufficient for average users, which are able to open exe file in
text editor (and read clear text) but not for advanced users which
understand assembler and disassemble your exe.

----------------------------------------------------------------------
devEric69 · 2021-08-10 12:33

For info., there's a good web page here: Anti Cracking FAQ. And for
real executable's [password + login] encryption, there is onguard (to
use a very rather big password with MD5 algo.) from the excellent
@graemeg (the author of fpGUI) + Turbopower.