Password Settings

[DJDDA]

I'm designing an application that has password-protected features. The password needs to be changeable by the project manager, who of course will not be able to edit the application. (It appears to me that I need an external file to hold this information; correct me if I'm wrong here.)

Now, I get that I can encrypt the password and I get that I can save it various file forms, but I want to idiot-proof it as much as is practical. My question, then, is: Is there a way to prevent the end user from directly opening my settings file at all, such that they can't "break" (render unusable) the current password?

[andre.buurman@carya]

Hide the file far away in the "Documents and settings\Application data\Your app" directory or use the registry to store the info. Both will however be found by users wanting to upset you.

[PaulG.]

You can save two copies of the same password data file in two different directories. When you need to retrieve the data you can compare the "last mod" info using File/Directory Info. If the last modification dates are different you know one of the files has been modified outside of the scope of your application. The corrupted file would usually be the one with the more recent modification date. Just use the older file as the backup.

[DJDDA]

Great, thank you both. Those solutions are both good--this doesn't really need to be "high security," but it needs to be good enough that someone who is in the mood to screw around with the program settings will have to work to get to this password. (If we do get someone determined to mess things up, we can simply reinstall the program, as it doesn't ever change much from its original form.)