securing data at the client side - vb.net

Question

am [writing reading] from a plain text file usernames and passwords, but its an bad way of securing data, is there any other way to do this, most probably by using IV's, encryption decryption algorithms.

Answer 1

You need to decide whether you need to be able to decrypt the text again or not. I would suggest that, for passwords at least, you can use a one-way hash You can make it a lot hard to brute force attack the hash if you make use of a salt. Ideally a separate, random salt should be used for each password: password+salt=hash. You need to store the salt as well as the hash but it can be stored in plain-text as it is not cryptographically secret. An example implementation (using SHA256):
public class SHA256
{
public static string GetHash(string password, string salt)
{
UTF8Encoding encoder = new UTF8Encoding();
SHA256Managed sha256 = new SHA256Managed();
byte[] hashedDataBytes = sha256.ComputeHash(encoder.GetBytes(salt + password));
return ByteArrayToString(hashedDataBytes);
}
/// <summary>
/// Generates a random 16 character alpha-numeric salt
/// </summary>
/// <returns></returns>
public static string GenerateRandomSalt()
{
const string allowedChars = "ABCDEFGHJKLMNOPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz0123456789";
char[] chars = new char[16];
var rd = new Random((int)DateTime.Now.Ticks);
for (int i = 0; i < 16; i++)
{
chars[i] = allowedChars[rd.Next(0, allowedChars.Length)];
}
return new string(chars);
}
/// <summary>
/// Converts supplied byte array to hex format string.
/// </summary>
/// <param name="inputArray"></param>
/// <returns></returns>
private static string ByteArrayToString(byte[] inputArray)
{
StringBuilder output = new StringBuilder("");
for (int i = 0; i < inputArray.Length; i++)
{
output.Append(inputArray[i].ToString("X2")); //Return in hex format
}
return output.ToString();
}
}
The GenerateRandomSalt method can be used to generate a salt for your password. There are lots of other questions covering this sort of thing on SO.

Answer 2

You can encode your passwords with HASHES like SHA1.
Function getSHA1Hash(ByVal strToHash As String) As String
Dim sha1Obj As New Security.Cryptography.SHA1CryptoServiceProvider
Dim bytesToHash() As Byte = System.Text.Encoding.ASCII.GetBytes(strToHash)
bytesToHash = sha1Obj.ComputeHash(bytesToHash)
Dim strResult As String = ""
For Each b As Byte In bytesToHash
strResult += b.ToString("x2")
Next
Return strResult
End Function
Using it is simple!
Console.Write(getSHA1Hash("password"))
So whenever you need to authenticate a user, you can take his input password, compute a hash of it using the above function and make sure it's the same with a simple IF clause:
if getSHA1Hash(input_password) = HASHED_OLD_PASSWORD then Authenticate()
SHA1 hashes aren't decryptable without sheer brute forcing every possibility so it's a pretty safe solution.