Remote connection scheme without Windows Authentication/Domain in detail
how safe is this remote SQL Server access scheme


The shared account credentials embedded in the application can be read by anyone who controls a computer on which the application runs.  No matter how you try to hide the credentials, you can never hide from a user with a debugger, who can just set a break point on the function that handles the password and examine the memory.  

And from the description, it sounds like having access to the shared user credentials would, at the very least, allow a user to perform actions as some other user.  So unless you really trust all these users, this scheme isn't very good.


  When a user is trying to login to the system, he actually sends his id and password to the application
  ...
  whether there is an alternative or better to say a best practice on this problem.


Create a SQL Server Login or Contained Database User for each application user, instead just storing the users in a table, and use the credentials presented by the user to authenticate to SQL Server.