Should I pass sensitive data to a Process.Start call in .NET?
.net, command-line, security, windows
Solution
Retrieving the arguments that a process was called with is quite easy, so they'll be exposed locally to a technically-minded user. If that's not a problem for you, then I wouldn't worry about it, since you say you're not transmitting over the network and your question asks us to assume the machine's not compromised.
Problem
I'm working on a .NET Windows application that will use Process.Start to launch another internally developed .NET application running on the same PC. I need to pass database connection information, including a user ID and password, to the target application. I'm trying to determine whether I need to encrypt the information before I send it. Assuming the end user's PC isn't compromised, will the connection information be exposed anywhere if I pass it unencrypted in the arguments? Would something like this be OK... ``` string myExecutable = "myApp.exe"; string server = "myServer"; string database = "top_secret_data"; string userID = "myUser"; string password = "ABC123"; string dbInfo = string.Format("server={0} database={1} userID={2} password={3}", server, database, userID, password); ProcessStartInfo startInfo = new ProcessStartInfo(myExecutable, dbInfo); Process.Start(startInfo); ``` Or should I use something like this... ``` var crypto = new MySymmetricCryptoLib.Crypto(); string myExecutable = "myApp.exe"; string server = crypto.Encrypt("myServer"); string database = crypto.Encrypt("top_secret_data"); string userID = crypto.Encrypt("myUser"); string password = crypto.Encrypt("ABC123"); string dbInfo = string.Format("server={0} database={1} userID={2} password={3}", server, database, userID, password); ProcessStartInfo startInfo = new ProcessStartInfo(myExecutable, dbInfo); Process.Start(startInfo); ```