How can I securely store SQL information in a Windows Form project?

Question

I couldn't find how to securely store SQL information in a C# windows forms application.

With tools like .NET Reflector, the code can appear somehow.

What is the most accurate and reliable method?

They suggest keeping it encrypted in app.config. However, decryption codes must be in the project.

Thus, it is easy to see how it is encrypted and how it can be decrypted.

Answer 1

The simplest way is to create a server application and route DB access through the server application.

There are ways to hide and encrypt sensitive data in an application e.g. by using SecureString. However there will always be point where the sensitive data exists in plaintext and this point will be the moment of weakness. All means of encryption will only reduce the amount of time sensitive data is present in a readable format for.

Thus using a server applications to act as an intermediary between your application and the client app is the best solution. As mentioned by @Good Night Nerd Pride, your server application will also need to implement authentication to ensure only authorised user's have access to the databse.