title: Encrypt TcpStream for Login Server - Necessary?
body: <p>I'm writing a C# .NET application that requires a secure Login. I've already got the necessary functionality to store passwords securely with a hash and salt in a database, however, I'm now moving from the testing phase. Before during development (the Login wasn't prioritized) I was just connecting to my database directly. I'm aware this is insecure for a production application as you blatantly store your database credentials in the code. Instead, I'm opting to create a simple Asynchronous TCP Socket server that listens for a username, sends the salt from the database back, then the client hashes the entered password (salt is stored locally temporarily) and sends that back to the server. The server then checks if they match; sends back true/false if the user checks out.</p>
  
  <p>I've done some research and looked into encrypting the TCP Connection, however, is this <em>really necessary</em>, since the password will already be hashed? Or is there a better way of doing things in entirety? I'm open to suggestions on how the client/server architecture should work. The Login doesn't play <em>that</em> important of a role in the application as a whole, but it will be production grade and I do not want to put a poorly designed application out there.</p>