(Aug 26, 2014 06:13 AM)Routess Wrote: Your code should never include the password, you should check it with a server or even use a Hash-Encryption.
Ofc there are a lot more things that you could improve but all in all its quite OK :)
Using a hash for comparison is about as secure as a plain text password when it comes to .net because if they can read the password through dis-assembly or memory scanning they can (almost always) also just replace the stored hash with an already known one or simply Null the check. Although I also would still go for a hashed password because you could implement checks in the code for the correct hash (again these could be patched).
Thinking on the matter further I would asymmetrically encrypt files using RSA. As it would be the best security against unauthorized removal because if the encryption has been done properly the only way your going to be getting those files back is by using the private key which only we know (which would have to be unique for each instance of the software, so needs some server side element to gen and distribute the keys).