C# + SQL Server 2000 + password in clear text problem

Hi, You can encrypt the connection string. I extracted this from the msdn article. // (6) Encrypted database connection string is held in the registry private static string GetConnectionString() { // Retrieve the cipher text from the registry; the process account must be // granted Read access by the key's ACL string encryptedString = (string)Registry.LocalMachine.OpenSubKey( @"Software\OrderProcessing\") .GetValue("ConnectionString"); // Use the managed DPAPI helper library to decrypt the string DataProtector dp = new DataProtector(DataProtector.Store.USE_MACHINE_STORE); byte[] dataToDecrypt = Convert.FromBase64String(encryptedString); return Encoding.ASCII.GetString(dp.Decrypt(dataToDecrypt,null)); } Reference http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/THCMCh14.asp Hope it helps. Cheers.

I believe a common solution is to create a data access assembly that is placed in the GAC which contains a function that returns a dataconnection object. GAC is secure and I don't think the dataconnection is sniffable.