IWorkspace.ConnectionProperies: How safe is the password?
Posted by Dave Bouwman | Posted in ArcMap, Geodatabase, Security | Posted on 28-02-2007
2
[UPDATE 3/1/07 8:00am : After a few emails with ESRI, they agreed that discussing their public API, as it relates to the security of passwords is reasonable, and they have confirmed that the password that is returned by IWorkspace.ConnectionProperties is encrypted. For obvious reasons they will not disclose any of the technical details. Thanks to ESRI for confirming this, and for permitting me to share the answer.]
[UPDATE 2/28/07 7:50pm : I received a request from ESRI to take this posting, and my related forum post down because they discuss security and encryption related to their software. At this time, I'm taking the posting down, and will work with them to determine a reasonable update. Stay Tuned]
[ORIGINAL POSTING]
I posted a question [I deleted it's contents at ESRI's request] over at the ESRI forums about this, but thought I’d also throw it out here as well. Essentilly, I’m looking to build a secure application, and I want to know if it’s possible to extract the connection password from the data returned by IWorkspace.ConnectionProperties. I posted some VBA code from an EDN sample that pulls the connection properties from the first layer in the map and displays the properties in a popup. All I added was a few lines which would actually write out the password byte array.
What I’d like to know (preferably from someone @ ESRI) just what that byte array is. I suspect it’s the password encrypted, but it could also be a hash. If it is the password encrypted, where is the key? How safe is it? If it is a hash, is it reversible?
[Clarification: In my original posting, I had asked a series of rhetorical questions (above) - I did not expect to get these answers from ESRI, nor do I really want them - I really just wanted to know that the password is "relatively" safe - i.e. encrypted.]


Thought it would be fun to gather the various ESRI bloggers and blog readers for some face to face conversations and beers. The ESRI Showcase and Vendor Expo ends at 7:00pm, so let’s meet up at about that time in the Wyndham bar (it’s in the lobby for those who have not been there before).



The
