Copyright: Password Component Help


Password Component - Overview

The password component was designed to prevent unauthorized persons from gaining access to an application. Since it does not contain a user id or a central password database, it is not suitable for situations where each user's data should be restricted. For example, it would work well keeping unauthorized users out of a library checkout system while letting a librarian access the system from any terminal, but it would not work well as an email system. It could easily be expanded to that function.

Password Component - Specifics

Password Component - Results


Password Component Component - Specifics
Password Component - Specifics

The encrypt routine stores the password into a long string of random characters. The password is evenly spaced out in the string, stored from back to front, and each character is left-shifted before being stored. Using srand with a fixed number means that encrypt called with the same string will return the same encryption. This enables the component to compare the stored string with what the user typed in.

Clearly, from the description of the encryption routine, any good hacker could bypass this dialog. Remember, though, that it is impossible to keep everybody out. The key to good security is to make it hard enough to break in that no one would consider it worthwhile. For better security, change encrypt to store the length of the password into the string and then be able to use srand with the system time to scramble the data. For best security, replace the encryption algorithm with something like RSA.


Password Component Component - Results
Password Component - Results

Passwords are currently stored in the program’s .INI file under the [init] section in the entry data1. They are stored using a simple one-way encryption. If you want to use the registry to store password data, just insert a call to CWinApp::SetRegistryKey into your InitInstance before making the CheckPassWord call.

If you select the "Users can set password" option, deleting the .INI file will let the user specify a new password the next time the program is run. Obviously this would be useful only in low-security applications. For better security, do not let the users set passwords. Instead create two versions of the program: a user version and an administration version. For the administration version, allow password creation. Whenever you need to change the password, run the administration version with no .INI file. Type in the new password at login. Now you can simply copy the .INI file to the users’ machines to change their passwords.


Password Component - Main Dialog
Password Component Dialog

Use the check boxes in this dialog box to select the security options you desire.

User can set password: When this option is selected, the password is set to whatever the user has entered if there is no current password data.

Allow multiple password attempts: When this option is selected, the user is allowed to retry passwords until either the correct one is entered or Cancel is pressed. If this option is not selected, the program will exit as soon as an incorrect password has been typed.

Accept empty password string: When this option is selected, the user can have a password of zero length. If a zero-length password is set, the user can run the program by simply choosing OK in the password dialog.