How do I store sensitive information in a .Net/WPF app?
.net, c#, desktop-application, security
Solution
Simple: You do not.
NO way to do that ever has worked. None. Ever. All copy protections that get cracked within days are based on "hey, I can hide something".
You can safely store user specific data in the user's specific folders - and leave it to the OS to protect these places. But thinking you can hide encryption keys in your app - basically: you can hide them if noone smart looks at them (or: no dedicated hacker). This may work - but it is "relying on people not really wanting to find it".
Problem
I need to store encryption/decryption keys for an encryption algorithm, on a public WPF application, available as free download to anyone. Obviously, I would like to store these keys in secure way, so that the user may not see them. As I see it, it's not possible, since it's very easy to decompile a .Net app, and obfuscating it doesn't do much. I can't think of a place to store these infos, that is either not user-accessible, or is "naturally" encrypted (like some kind of "Windows vault", but then the user could create an application pretending to be my own, wouldn't he?) From the moment the user has access to the (compiled) code and the (clear) app.config, I don't see how I can store sensitive informations locally. I saw plenty of help to encode connection strings and securing stuff on IIS, but none on WPF applications. Is there any way to securely store arbitrary data with .Net/WPF? Thanks!