WD24 - Hpass

When I encrypt a file I need to code HPass(File,"Password") in my code, so the password can be read by someone that has access to the code.
Is there a way to hide this, so a file is "really" protected.

Thanx for any help.

Regards,

Aad

Let the password be an input field, and those want to Password protect it, can enter the password and protect it. This way no one, even the coder knows the password that will be set by the end-user.

HTH

Hi sivakrith,

I have 20 users on this files so that's no way to go. Users are not aloud to know the password, because it can be leaked.

Thanks for your suggestion anyway.


Regards,

Aad

Anything we do in code could be read by those who have access to that part of the code.

The other way could be to develop a separate internal component, which does the necessary things like setting the password and opening the files etc. You can keep the component part securely.

Hi Aad,

there are encrypt / uncrypt. Do an encrypt outside the program, just to have the encrypted password string as a text. Put this one into the program as a constant like YourString is Ansi string = "&%GhatQQ". Then HPass(YourFileName, Uncrypt(YourString, MyCompanyName, cryptRC516, encodePCS))

Kind regards,
Guenter Predl
office@windev.at

Hi Guenter,

Thanks for this option. I will look into it.

Best regards,

Aad

You are trying to prevent other developers working on your project to know the files password, and therefore be able to access your customers data...

If that is the case, then all the solutions above have the consequence of preventing your developers to use external tool (wdmap, hfcontrolcenter) to verify what's happening in the files...

Instead, I would suggest the following:

1. do not use customer data for your developers, but instead have a test DB containing only non confidential data
2. place the password, ENCRYPTED inside an ini file (or equivalent)... THIS WILL ALLOW YOU TO HAVE A DIFFERENT PASSWORD in development and in production... In your program use the decrypt method descibed above by Guenter.
3. give the password of the development database to your extra developers so that they can debug using all the tools, but only on the dev DB
4. create a small external tools to create the encrypted password/ini file and give the production version to whomever is in charge of crfeating the exe/installer
5. make sure that this production ini file is installed WITH the EXE.

You are the only one who can access the production DBs...

You can even, if necessary, have a different DB password per customer.

Hi Argus,

Thank you for your response. The reason for this is, that the files are on VPS's. They can be hacked and privacy data wil be available for the bad guys. We, as hosters, are responsable for this data en will be prosecuted in case of data leakage (Dutch law AVG).
That's the only reason that we want to scramble the files. It sounds silly and most of the time it won't happen, but we have to prove to our customers that their data is dafe,

Best regards,

Aad



Edited 3 time(s). Last edit at 04/24/2020 05:04PM by AadG.

WHERE you files are has no bearing on the way you manage the file passwords in the SOURCES of your application.
If that is your only concern and you do not want to hide the password from the developpers, then Guenter's solution is enough.