pwdencrypt and Case sensitive

Hi there
I know how to use pwdencrypt for my password and know how to use collation,
but how can I merge it together to make my password case sensitive and
pwdencrypt working, because collation only not support varbinary and my
pwdencrypt is saved on varbinary data type.
Any one has idea how to to this?
Thanks
Tony
I believe pwdencrypt behavior depends on the instance default collation. In
any case, you shouldn't use the undocumented pwdencrypt function in your
code. This may change or be removed in future SQL Server service packs or
versions.
Hope this helps.
Dan Guzman
SQL Server MVP
"Tony Dong" <tony.dong@.envoytrading.com> wrote in message
news:Oy07MZsRFHA.996@.TK2MSFTNGP09.phx.gbl...
> Hi there
> I know how to use pwdencrypt for my password and know how to use
> collation, but how can I merge it together to make my password case
> sensitive and pwdencrypt working, because collation only not support
> varbinary and my pwdencrypt is saved on varbinary data type.
> Any one has idea how to to this?
> Thanks
> Tony
>
|||> I know how to use pwdencrypt for my password
If you knew that then you wouldn't be using it. ;-) Don't.
..NET provides classees for generating password hashes. They are more secure
than pwdencrypt and they are also properly documented and supported whereas
pwdencrypt is likely to break or disappear in future releases.
David Portas
SQL Server MVP
|||I am Tony's coworker and using .NET to encrypt the password is not an
attractive option because it means that we cannot operate the database
without .NET. It makes the business tier and database tier tightly
coupled or to use some of my old C++ jargon "It breaks encapsulation!"
If we were using Yukon, then .NET would be the way to go.
Cheers
Ted
*** Sent via Developersdex http://www.codecomments.com ***

pwdencrypt and Case sensitive

Hi there
I know how to use pwdencrypt for my password and know how to use collation,
but how can I merge it together to make my password case sensitive and
pwdencrypt working, because collation only not support varbinary and my
pwdencrypt is saved on varbinary data type.
Any one has idea how to to this?
Thanks
TonyI believe pwdencrypt behavior depends on the instance default collation. In
any case, you shouldn't use the undocumented pwdencrypt function in your
code. This may change or be removed in future SQL Server service packs or
versions.
--
Hope this helps.
Dan Guzman
SQL Server MVP
"Tony Dong" <tony.dong@.envoytrading.com> wrote in message
news:Oy07MZsRFHA.996@.TK2MSFTNGP09.phx.gbl...
> Hi there
> I know how to use pwdencrypt for my password and know how to use
> collation, but how can I merge it together to make my password case
> sensitive and pwdencrypt working, because collation only not support
> varbinary and my pwdencrypt is saved on varbinary data type.
> Any one has idea how to to this?
> Thanks
> Tony
>|||> I know how to use pwdencrypt for my password
If you knew that then you wouldn't be using it. ;-) Don't.
.NET provides classees for generating password hashes. They are more secure
than pwdencrypt and they are also properly documented and supported whereas
pwdencrypt is likely to break or disappear in future releases.
--
David Portas
SQL Server MVP
--

pwdencrypt and Case sensitive

Hi there
I know how to use pwdencrypt for my password and know how to use collation,
but how can I merge it together to make my password case sensitive and
pwdencrypt working, because collation only not support varbinary and my
pwdencrypt is saved on varbinary data type.
Any one has idea how to to this?
Thanks
TonyI believe pwdencrypt behavior depends on the instance default collation. In
any case, you shouldn't use the undocumented pwdencrypt function in your
code. This may change or be removed in future SQL Server service packs or
versions.
Hope this helps.
Dan Guzman
SQL Server MVP
"Tony Dong" <tony.dong@.envoytrading.com> wrote in message
news:Oy07MZsRFHA.996@.TK2MSFTNGP09.phx.gbl...
> Hi there
> I know how to use pwdencrypt for my password and know how to use
> collation, but how can I merge it together to make my password case
> sensitive and pwdencrypt working, because collation only not support
> varbinary and my pwdencrypt is saved on varbinary data type.
> Any one has idea how to to this?
> Thanks
> Tony
>|||> I know how to use pwdencrypt for my password
If you knew that then you wouldn't be using it. ;-) Don't.
.NET provides classees for generating password hashes. They are more secure
than pwdencrypt and they are also properly documented and supported whereas
pwdencrypt is likely to break or disappear in future releases.
David Portas
SQL Server MVP
--|||I am Tony's coworker and using .NET to encrypt the password is not an
attractive option because it means that we cannot operate the database
without .NET. It makes the business tier and database tier tightly
coupled or to use some of my old C++ jargon "It breaks encapsulation!"
If we were using Yukon, then .NET would be the way to go.
Cheers
Ted
*** Sent via Developersdex http://www.codecomments.com ***

putting user accounts on the database

hii all;

My question is from 2 sections:

1- Is it secure to put user accounts (userName and password ...) on the database?

2- How can I set username and password for SQL server 2005 express file?

Thanks

Hi Abdul-Rahman,

"1- Is it secure to put user accounts (userName and password ...) on the database?"

Actually, the fact that you have concerns about storing the passwords in the database show that it isn′t secure :-) In my past project with SQL Server 2000, I always used a encryption function in the middle tier which encrypted the password, send the encrypted text to SQL Server which did the comparison of the stored and send encrypted password. So the logic and the security layer was on the middle tier. In SQL Server 2005 there are more security enhancements like enryption of data:

http://www.databasejournal.com/features/mssql/article.php/3483931

AFAIK, there is no password on the database file. If you have access to attach the database file you are free to attach it, but as somebody has another opinion or facts about that, I would be glad to hear that.

HTH; Jens Suessmeyer.

|||

(1) You can protect information in various ways. But to decide how secure your protection scheme is you should provide additional information: how do you use that information and against whom you are trying to protect it?

(2) What file are you referring to? Please provide additional information.

Thanks
Laurentiu

|||

Hi all;

First, my application is based on storing some data about customers, and I hope to make something to prevent anyone from opening or connecting to the database directly and watching or editing its data, but instead, specific users can enter an application that can deal with data in tables.

I think there's a way, because I see some where connection string that has something like: "... username=someUser ... password=pw..."

and I think this means the program enters the password to enter the DB.

"(2) What file are you referring to? Please provide additional information"

SQL2005 Express File, which ends with .mdf extension.

Thanks

|||

(1) SQL Server can do the authentication for you, which means you don't have to store passwords in a table and process them yourself. See Books Online, the topics on creating logins and users (CREATE LOGIN, CREATE USER). SQL Server 2005 stores SHA1 hashes of the SQL login passwords and the hashes are only visible to system administrators. If you use Windows authentication, no password is stored in the server. Books Online has more information on this:

http://msdn2.microsoft.com/en-us/library/ms130214.aspx

(2) There is no password for mdf files. If you store sensitive information in the database, you should look at the encryption features. To protect the mdf file, you should restrict access to it in Windows.

Thanks

Laurentiu