在Java桌面应用程序中安全存储数据库密码的位置

在Java桌面应用程序中安全存储数据库密码的位置

问题描述:

我一直在寻找类似的问题,但是我没有找到正确的答案,我认为必须有一些安全的解决方案.

i was looking over the similarly questions but i didn't find the right answer and i think that there has to be some secure solution.

我有客户端服务器应用程序.客户端正在连接到服务器上的*MySQL数据库.我的问题是如何在客户端桌面应用程序上保护存储数据库密码.现在,我将其以crypt形式存储在java属性文件中.但是属性文件是可读的,并且在反编译我的应用程序之后,每个人都可以看到我使用哪个crypt函数对密码进行编码,并且可以轻松地获取密码.所以我认为没有办法安全地将db密码存储在客户端应用程序中,对吗?

I have the client- server application. The clients are connecting to the central MySQL database which is on server. My problem is how to secure store database password on client desktop application. For now i am storing it in crypt form in java properties file. But properties files are readable and also after decompiling my application everybody can see which crypt function i use for encoding the password and can easily get the password. So i think that there is no way how to secure store the db password in client application, am I right?

解决方案可以是客户端应用程序将与服务器进行一些握手以获取数据库密码,该握手有任何规则或模式吗?

The solution can be that the client application will do some handshake with the server to get the database password, is there any rules or patterns how to do this handshake?

看看 OAuth 进行授权.