title: Is it really possible to protect a connection string in app. config?
body: <p>We want to protect the login information that is used to connect to our SQL Server database from a .NET windows application.</p>
  
  <p>This information is stored as a connection string in an <code>app.config</code> file on the client PC.</p>
  
  <p>Almost everywhere it is suggested you encrypt your connection string using </p>
  
  <pre><code>(ConnectionStringsSection)config.GetSection("connectionStrings").ProtectSection();
  </code></pre>
  
  <p>However, a malicious user that wants your database password, could just copy the encrypted config file, use it with it's own application, and call</p>
  
  <pre><code>(ConnectionStringsSection)config.GetSection("connectionStrings").UnprotectSection();
  </code></pre>
  
  <p>This will decrypt the connection string back to plain text.</p>
  
  <p>Is there any way to really protect a database password in a .NET application that is stored on a user's PC?</p>
  
  <p><strong>EDIT</strong>: to further clarify the situation, we are indeed talking about a malicious user (read: competitor) that has access to the same PC and wants the password.</p>
  
  <p>As a secondary measure, we first encrypt the password ourselves, save it to <code>app.config</code> and then call <code>ProtectSection()</code>. This will make <code>Unprotect()</code> output the encrypted password. But the user will still be able to decompile our code and figure out our encryption key and algorithm that is used...</p>