Member Avatar for koolsid

I didn't find creating login screens and saving the data in access database difficult...

However, I was wondering if there is any other way we could do that, i mean saving the username and passwords in any other file rather than a database and encrypting the same...

Rgds

Sidz

  • 4 Contributors
  • 8 Replies
  • 218 Views
  • 2 Years Discussion Span
  • Latest Post Latest Post by jireh

Dani AI

Generated

Clarifying, practical notes for storing VB6 login data in a flat file (building on and ):

Storing reversible ciphertext in a flat file is workable but safe handling of the encryption key is the hard part. For pure authentication the standard, safer approach is to store a salted, iterated one‑way hash of the password (so the password cannot be recovered). If decryptable storage is truly required (for migration or sync reasons), use an OS-backed protector (Windows DPAPI / CryptProtectData) or a well‑tested library that offers AES + HMAC with proper IV and key management. Rolling a custom substitution or embedding static “constants” in an ActiveX is weak because binaries and ActiveX can be reverse‑engineered.

A compact, practical file layout keeps each user as a single record so the username/password stay linked and metadata (salt/iterations/iv) travels with the credential. Example line (pipe separated for clarity):

alice|RANDOM_SALT_BASE64|10000|HASH_OR_CIPHERTEXT_BASE64

Implementation notes specific to VB6 and this thread:

  • Prefer existing crypto implementations (third‑party ActiveX or native Windows APIs) rather than hand‑rolled ciphers.
  • Store per‑user salt and iteration count when hashing; regenerate salt on password change.
  • Use a Dictionary (Scripting.Dictionary) or a small user class/UDT to keep username => record mappings in memory (answers ’s array question).
  • Protect the file with OS ACLs, minimize who can read it, and consider encrypting the entire file for an extra layer (but don’t rely on that as the only protection).
  • Implement constant‑time comparison for hash checks and include integrity (HMAC) if reversible encryption is used.

Finally, ’s point is valid: if a database file is compromised, encrypting application data at rest mitigates exposure. The core rule remains: use established cryptography and manage keys outside easily‑reversed binaries.

Recommended Answers

All 8 Replies

Member Avatar for Comatose

could You Elaborate Just a little more on exactly what you are trying to get done here? You want to store the passwords in a textfile (or database) with the username and encrypted password?

Member Avatar for koolsid

yes i want to save the username and password in a text file and not in a database.

i want the username and password both to be encrypted. when anyone opens the file in a note pad it should somehow look like this...

[USERS]

fgdfs565dyjtj ==> encrypted username1
ghhghfgjh ==> encrypted username2
hfjhgkjgjk ==> encrypted username3
hjkgjk ==> encrypted username4

[PASSWORD]

gfhrty67676 ==> encrypted password for username1
hyrhryhyrh ==> encrypted password for username2
hrhyrhyhryh ==> encrypted password for username3
gfdhyt6477 ==> encrypted password for username4

the program should work viceversa as well. i mean decrypting the data

Member Avatar for Comatose

So, You don't want the program to create a hash... you want it to create encrypted data. (a hash is an encrypted string [like a password], that CAN NOT be decrypted). Also, I'm just curious as to the format of the password file (why you are using that method) instead of the traditional standard method? I'll send you the code to do what you want when I get home (I'm working now), but I'm just curious as to the reasons why you chose A) to decrypt instead of hashing B) using that file format.

Member Avatar for koolsid

Simply because, data stored in a access database can be hacked easily... I have a software which can decode the password protected access database...

Would really appreciate if you can send me the code. i'll try that out as well.

Can we play around with strings??? for example lets take a string "WORLD" suppose i want to replace "O" with "cv44v" or any other letter say "L" with say "df5gh" and write an active x dll for the same... that way we can encrypt/decrypt the PASSWORD and USERNAME... (it is just a thought...)

Member Avatar for Comatose

Actually,

I wasn't referring to an access database (or even a database of any kind) so much as I was refering to the setup of your flat-file password file. You have it setup very similar to an .ini file. while this is doable, this is also a lot more difficult to work with in code. The Linux Password File (and most other password files [including flat files]) are setup in a fashion similar to: username:password

The : doesn't have to be the delimiter, anything can be really, but this makes coding a little easier (by way of arrays, with the split function). As for using your own function for encrypting the strings.... that too isn't going to be very secure. This is becuase in order to decrypt the strings, you have to have something constant. Perhaps considering hashes would be a better solution, or look for an activeX control for using PGP, or blowfish. I'll still help you either way, but for security basis, you may want to look into something like hashes, or pgp or blowfish.

Member Avatar for koolsid

hmmm

there goes my idea of playing with strings.... ;) is it still insecure if we define those constants in activex controlls??? can they be reverse engineered?

anyways anxiously waiting for your code...

Member Avatar for seeleo6

first off how do you make a array hold a array for username and password?

Member Avatar for jireh

just a thought... I have also a program that can "get" the password in the pasworded database but think it still secure because all the data in the database I'm creating was all encrypted so the hacker can't still read the data stored. "just a thought"

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.