C# db connection security

Question

I have a small C# desktop application. It connects to postgres db server. I will distribute this application to some users.

Now my question; Is someone can get my connection string (username, password) with local port listener software or any other software?

If answer is yes, how can I prevent this?

Thank you.

Answer 1

Yes. Your application could be decompiled and your app.config could have the password.

You could use an SSL connection and encrypted app.config.

Ideally, you could have a master service that would own talking to the database and your child applications would be clients.