How should I go about creating a registration page in Windows forms? I can easily create a registration page, but I'm not sure if it's the best way. I'd have a service account that is hard coded, and it creates entries in a user table. I don't like to hard code passwords, but I don't know of another way. I guess in every case I'd end up having to hard code a password, right? I do have SSL enabled, and I've Wiresharked it and was unable to read any of the traffic.

Here's a simplified example of some code I wrote a while ago:

Public Class Registration
Dim connStr As String = "server=domain.com; port=3306; user id=userid;password=password;database=db;SslMode=Required;"
Dim msc As New MySqlConnection

Private Sub registerBTN_Click(sender As System.Object, e As System.EventArgs) Handles registerBTN.Click
            Dim dr As MySqlDataReader
                dr = checkUsername.ExecuteReader()
            Dim match As Boolean = False
            While dr.Read()
                If dr("Username").ToString = usernameTXT.Text Then
                    match = True
                    Exit While
                End If
            End While
            dr.Close()
            If match = False Then
                Dim User_GUID As Guid = New Guid
                User_GUID = Guid.NewGuid()
                Dim Encrypted_Password As String = Encryption(passwordTXT.Text, User_GUID.ToString)
                    Dim mscCMD As MySqlCommand = New MySqlCommand("INSERT INTO Users (Username, UserID, Password, Profile, Email) " & _
                                                                      "VALUES (@uname, @id, @pwd, @url, @mail)", msc)
                    With mscCMD.Parameters
                        .AddWithValue("uname", usernameTXT.Text)
                        .AddWithValue("id", User_GUID.ToString)
                        .AddWithValue("pwd", Encrypted_Password)
                        .AddWithValue("url", urlOptTXT.Text)
                        .AddWithValue("mail", emailTXT.Text)
                    End With
                    mscCMD.ExecuteNonQuery()
                MsgBox("Registration successful!", MsgBoxStyle.Information)
                My.Settings.First_Run = False
                Me.DialogResult = Windows.Forms.DialogResult.OK
                Me.Close()
End Sub

Private Sub Registration_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        Try
            msc.ConnectionString = connStr
            msc.Open()
        Catch ex As MySql.Data.MySqlClient.MySqlException
            Me.Close()
        End Try
    End Sub

I want to know if this is a good approach. Does this have any vulnerabilities? Is there a better way to create a user registration method?

Also, here's my encryption/decryption.

Public Function Encryption(ByVal Plaintext_Password As String, ByRef User_GUID As String) As String
    Dim guidANDPassword As String = User_GUID.ToString + Plaintext_Password
    Dim shaobj As New Security.Cryptography.SHA1CryptoServiceProvider
    Dim guidPwdBytes() As Byte = System.Text.Encoding.ASCII.GetBytes(guidANDPassword)
    guidPwdBytes = shaobj.ComputeHash(guidPwdBytes)

    Dim Encrypted_Password As String = String.Empty

    For Each b As Byte In guidPwdBytes
        Encrypted_Password += b.ToString("x2")
    Next
    User_GUID = User_GUID.ToString()
    Return Encrypted_Password
End Function


Public Function Decryption(ByVal Plaintext_Password As String, ByVal User_GUID As String) As String
    Dim guidANDPassword As String = User_GUID.ToString + Plaintext_Password
    Dim shaobj As New Security.Cryptography.SHA1CryptoServiceProvider
    Dim guidPwdBytes() As Byte = System.Text.Encoding.ASCII.GetBytes(guidANDPassword)
    guidPwdBytes = shaobj.ComputeHash(guidPwdBytes)
    Dim Encrypted_Password_Of_Specified As String = String.Empty

    For Each b As Byte In guidPwdBytes
        Encrypted_Password_Of_Specified += b.ToString("x2")
    Next
    Return Encrypted_Password_Of_Specified
End Function
share|improve this question
    
First store sqlQuery in const string because pass query like that generate sqlexception or second thing you can take password from the user and after that you can encrypt those password for encrypt the password follow this link "stackoverflow.com/questions/1678555/… it will help for you. – Pankaj Gupta Nov 29 '15 at 7:35
    
Are you saying storing a SQL Command in a Constant will prevent an exception? So, an exception is possible? How? I've already gotten encryption down (notice Dim Encrypted_Password As String = Encryption(SQL Statement) line. That refers to a class I made to do encryption. – user287848 Nov 29 '15 at 9:12
    
Are you talking about Windows Forms or Web Forms - both are different techniques. Based on the code I assume this a Web Form application – Fabio Nov 29 '15 at 15:48
    
I'm talking about Windows Forms. – user287848 Nov 29 '15 at 19:32

If you are going to distribute this assembly, you are effectively distributing that password. Tools such as ILSpy can decompile the assembly and the database will be compromised.

The Windows Forms application shouldn't directly connect to a remote SQL server, there should be a service or API layer on the web sever to handle that.

If you need to authenticate / authorize a user, they will need to each have their own logins.

WinForms should act like a thin client, just sending requests to the server and receiving responses.

The web server should receive, authenticate, authorize and execute those requests on the database, and then send a response.

share|improve this answer
    
By assembly, you mean the EXE? Yes, this will be part of a publicly available program. Do you have any examples? All I find are simple examples similar to what I posted here. Yes, users will register and login like any other web service. – user287848 Nov 30 '15 at 17:23
    
From what I gather, I just separate the service account hard coded in the distributed program. I keep that on the server, where no one has access to decompile it. Essentially, I am limiting access to that service account and any authentication (from service account) is done locally rather than via the Internet. – user287848 Nov 30 '15 at 17:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.