[Advanced practice] -- Improving C # program quality (7)

113. When declaring a variable, consider the maximum value.

The maximum value of ushort is 65535. This variable may overflow for different purposes. Therefore, we should fully understand the maximum value of each variable during design. 114. MD5 is no longer secure.

MD5 is mostly used for information integrity verification. R = H (s), the MD5 algorithm is irreversible, that is, it is almost impossible for us to restore the original text based on the generated MD5 code. However, we can use the exhaustive method to generate an MD5 code for comparison. Because the passwords we usually set are relatively simple, such as 123456, they do not need to be cracked for a long time. To effectively prevent cracking, a feasible method is to add a fixed string "% ￥ #...... @! & × () ", And then perform MD5 encryption, which increases the difficulty of reverse enumeration. Here it is assumed that the hacker has obtained the MD5 string saved in the DB, instead of entering the password on the user interface. 115. Check whether the file is tampered with by using the hash value.

The hash value generated by the MD5 algorithm can be used to verify the integrity of the file. Although the same hash value can be obtained for multiple different samples, the probability is not large. 116. Avoid using asymmetric algorithms to encrypt files.

Asymmetric algorithms have high strength and are executed slowly. They are not suitable for file encryption. You can use symmetric algorithms to encrypt files. 117. use SSL to ensure data security in communications.

For more information about SSL (Secure Socket Layer), see other related documents. 118. Use securestring to save sensitive data in the computer.

The string object is visible in the memory and cannot be displayed and destroyed. It can only be destroyed by the garbage collector. For some programs that scan memory maliciously, information such as the bank card password is easily leaked. The characters stored in the securestring are encrypted and stored in the unmanaged memory. We use the. appendchar method to add characters. Use intptr = marshal. securestringtobstr (SS); string original = marshal. ptrtostringbstr (PTR); to obtain the original string. In addition, the pointer PTR must be destroyed using marshal. zerofreebstr (PTR ). 119. Do not use your own encryption algorithm.

Algorithms cannot be kept confidential and can be cracked through some decompilers or other means. The well-known encryption algorithms, such as des, are open algorithm logic, and the key that really needs to be kept confidential is the key. Our own encryption algorithms have not been verified and are almost impossible to secure than popular algorithms such as des. After all, we are not cryptographic experts. 120. Use a strong name for the Assembly.

The signature of the Assembly ensures the uniqueness of the Assembly. Even if a file with the same name exists, it can be normally distinguished without causing call failure. The Assembly windowsformsdynamic before the signature, version = 1.0.0.0, culture = neutral, publickeytoken = NULL, after the signature windowsformsdynamic, version = 1.0.0.0, culture = neutral, publickeytoken = 38a587009b65cbfe has a unique public key. When using this DLL, we must specify the complete assembly information, including the Public Key key, such as the reflection, before we can use it normally. You can use the x509store class to view the installed digital certificates on the local machine. 121. Set the running permission for the application.

By adding the [principalpermission (securityaction. Demand, role = @ "users")] feature to a method or class, you can specify that only users in the specified group can run the program. Otherwise, an exception is thrown. Of course, we also need to enable Windows Authentication appdomain. currentdomain. setprincipalpolicy (system. Security. Principal. principalpolicy. windowsprincipal );. We can also customize users and groups: genericidentity identity = new genericidentity ("examuser"); genericprincipal principal = new genericprincipal (identity, new string [] {"users "}); thread. currentprincipal = Principal; this gives you great flexibility in security control.

[Advanced practice] -- Improving C # program quality (7)