asp.net - Why encrypt a web config file? -


as far can tell, section in web.config file can encrypted & decrypted using aspnet_regiis.exe.

if aspnet_regiis can used decrypt web.config file, what's point of encrypting it? keep passwords & sensitive information being stored plain text? if file , exe can decrypt it, protect sensitive config info?

update

thanks answered regarding machine key. reason asked question because have open source project hosted @ codeplex.com. however, deploy project windows azure. trying find best approach keep sensitive passwords out of source control, keep them accessible part of project when deploy azure.

currently, using web config transforms store azure connection strings (as gmail passwords system.net). i've created web.publishtoazure.config transform file, , kept file out of source control. found this article may better option. again.

simplistic answer: won't have access key

i believe default key stored in machine's certificate store, malicious user need have access too. i'm not expert that's gist of it.


Comments

Popular posts from this blog

c# - how to write client side events functions for the combobox items -

exception - Python, pyPdf OCR error: pyPdf.utils.PdfReadError: EOF marker not found -