0

In my ASP.NET web application I need to save a password in a database. (Note that this is not a login password and a user providing such password is given a visible security warning.) I was thinking to provide some scrambling for the password before placing it into the database.

So I was thinking to do this:

byte[] bytesToSave_Scrambled = 
System.Security.Cryptography.ProtectedData.Protect(
    System.Text.Encoding.UTF8.GetBytes(password), null,
    System.Security.Cryptography.DataProtectionScope.CurrentUser);

The issue is that according to this page, when I use DataProtectionScope.CurrentUser only that same user account will be able to decode it back. I can of course use DataProtectionScope.LocalMachine instead, but the documentation says that it is less secure.

So my question is, when my web app runs on a web server, does it run under the same Windows user account to ensure consistency of the scrambling method above?

4

0 回答 0