Search code examples
c#securityembedded-resource

C# security of resource files


I was looking for this an hour, but I didn't find anything.
I read a tutorial about resource files and I decided to try them. I was surprised when I saw the output, because the resource files were changed in DLLs and weren't in the .exe file.

My question are:

  • How are these files safe?
  • What is safe to store in them?

Solution

  • The first Google hit on "resource files security site:msdn.microsoft.com" states:

    Caution

    Do not use resource files to store passwords, security-sensitive information, or private data.

    They don't say that for no reason: a resource file is by default not encrypted or obfuscated, so anyone with any program like a resource editor, msil.exe, or JustDecompile can see the contents of your resource file.

    You can apply encryption using some sort of key, but then again you'd have to store the key somewhere to decrypt the resources. This key itself is then subject to the same problems: where do you securely store that, so an attacker can't use it to decrypt your resources?

    It's nigh impossible if you have to distribute your program, so simply look for an alternate solution. Perhaps explaining what exactly you're trying to do helps towards a useful answer.