title: How To Encrypt Connection String in Web.config - Retired Content?
body: <p>I currently have an ASP.NET website that has an encrypted connection string within it's web.config file.  The settings are in the general AppSettings section, not the ConnectionString section.  Within the application code we manually decrypt the connection string at run time as needed.  </p>
  
  <p>While working on refactoring the site, I came across a method that Microsoft once suggested which involves running an <code>aspnet_regiis</code> command in order to insert encrypted data directly into the ConnectionString section of the web.config file.  This suggested method is now considered Retired Content although it doesn't say why (other than a small reference that some of the links may no longer be valid).</p>
  
  <p>Here's the site I'm referring to:<br>
  <a href="http://msdn.microsoft.com/en-us/library/ff647398.aspx" rel="nofollow">How To: Encrypt Configuration Sections in ASP.NET 2.0 Using DPAPI</a></p>
  
  <p>My questions are basically - Should I bother refactoring the existing functionality to use Microsoft's once recommended way?  I believe it would be more efficient than the current process.  Also, why would this method be considered Retired Content?  Is there a better way to do this, rather than my site supporting the encrypt/decrypt methods?</p>
  
  <p>I've search Google &amp; StackOverflow for other ways of doing this, but they all seem refer to Microsoft's way - or the way I currently have it implemented.</p>