More hidden, probably. To be more reliable, you need to define what
reliable means.

If your software is running in the context of the logged on user, the
user is able to do whatever the software is able to do, so all you can
hope to achieve is to obfuscate the storage process so much that the
user either loses track, or give up because it's so much work. You can
not store the data in a secure manner that only your software has access to.

For instance, using a decompiler (Reflector) or just using your class
libraries, a user could perhaps write a new program that read out the
values.

To prevent fraud, implement your security on the server where the user
cannot get anywhere except for inside the boundaries you've set, and let
the user type in the password each time.

Are you trying to prevent someone from learning the information, other
than the user? Ie. user uses the program, then closes it and leave the
computer, and you want to prevent someone else from going up to the
computer and learning the password, or similar cases? If so, then the
answer is to not store the password on the computer at all.

If you must keep things locally then do not store the
username/password but instead store a cryptographic hash of the
username/password.  For extra security use some random salt as well.

For a new application you should use SHA-256 as the hash.  For
cryptographic salt see
http://en.wikipedia.org/wiki/Salt_(cryptography).

When the user enters their username and password calculate:

 hash = SHA-256(username || password || salt)  (|| = concatenate)

Store the hash and random salt locally.  When the user next enters
their password repeat the calculation and compare the hash values.  If
there is a mismatch then do not allow the user access.  Each user
should have their own different salt.

Cryptographic hashes are designed so that it is not possible to run
them backwards and deduce the original text from the hash value.  The
salt is to make dictionary attacks more difficult.

rossum

Have a look at IsolatedStorage. There are special .NET classes to work with it.
-- Peter
Site: http://www.eggheadcafe.com
UnBlog: http://petesbloggerama.blogspot.com
Short Urls & more: http://ittyurl.net