Leaving passwords unencrypted in a configuration file is generally considered a bad idea. Although some level of access is required to get to the file, encrypting the passwords—especially database passwords—adds a layer of security. However, implementing this type of encryption has been a bit difficult until ASP.NET 2.0. Microsoft provided the Data Protection API prior to 2.0, but did not provide a .NET interface to these methods. With ASP.NET 2.0, you now have the ability to encrypt portions of your configuration file by using the aspnet_regiis.exe utility, located in the \Windows\Framework\v2.0.50727 folder (assuming your Windows root is ..
