How to securely protect web.config

Question

Perhaps I understand that this is all wrong, but since I realized that the best way to protect your connection string is to encrypt it, now I have these questions.

Question 1:

will encryption work in a co-hosting environment?

Question 2:

If I have an FTP service, can anyone upload an .aspx file and get a connection string through the namespace of the configuration manager?

Answer 1

Question 1:

What do you protect your connection string?

If it is against hackers, etc., if available to them web.config, your system is already compromised, and nothing you can do will help you.

(.. ), - , base64.

2:

, aspx - , .

Answer 2

1: , .

2: , . , - Windows , Windows IIS. , .

Answer 3

Not the answer to your 2 questions, but: The best way to protect the connection string does not have a connection that requires a password in the connection string. NTLM or similar is much more secure. In addition, if users have access to FTP encryption, this is the so-called security by unknown, which can be easily canceled.