Working with strings
Your application likely has strings. Most of them are irrelevant to the outside world; if you write “Hello World” to a console, an attacker probably couldn’t care less about that. But other strings are a lot more interesting to these people. Consider connection strings to a database, for instance. They can be an excellent resource for a hacker. Then, there are other data, such as user information, passwords, and credit card information.
We can distinguish between two types of strings:
- Strings that are part of your code and thus are compiled in the binaries
- Strings that are handled in your code and originate from an outside process or go to an outside process
Let’s see whether we can protect this sensitive data.
Protecting settings
First, we deal with the strings in your application that are part of your code base. Think of things such as passwords and connection strings. In an ideal world, you store this information...
