C# settings hidden for user

I want to ge开发者_JAVA技巧t and set some application settings hidden for the user. In this case these are two tokens and two tokens that are being altered by the application. But still all four them are a secret to the application user.

I found two ways on MSDN and this forum.

• Use a .config file. -> this sounds okay and I can change some values in it. But I see still a plain text file after publish.
• Use the settings in the project properties. -> should it be? I read warnings about that this not so secure after all.

A lot of sites describe a web server solution while I just want to have a desktop solution.

Btw. It is not a commercial product, I am making a hobby project to learn more from C#.net.

If these files need to be altered by the application, you will need to persist these outside of the application so that the new settings will be loaded next time the app starts.

For this, you can always create a config (or settings) file and hide it in the System.IO.IsolatedStorage files for the assembly. This is still editable by the user, but its a bit of a pain to find - plus this will transfer over with roaming profiles so that the settings are used cross machine.

Something simple to help you start out:

IsolatedStorage.IsolatedStorageFile storage = IsolatedStorage.IsolatedStorageFile.GetUserStoreForAssembly();

string subdirectory = "SomeDirectory";
storage.CreateFile(System.IO.Path.Combine(subdirectory, "settings.config"));

Does the * existence* of the setting need to be kept secret, or just its value?

If the latter, I'd suggest encrypting the value you save to the .config file.