Every example of encrypting web.config sections uses some built in ASP.NET objects with a provider string, such as this example shows: http://davidhayden.com/blog/dave/arc...1/17/2572.aspx

My question is: if a malicious person managed to gain access to the server's file system, what would prevent that person from uploading their own .aspx page with the same code to unprotect sections in web.config?

...nothing will prevent it.

Or conversely that we don't have any security experts handy. Real security gurus are hard to come by.

__________________
-------------------------

Whatever you can do or dream you can, begin it. Boldness has genius, power and magic in it. Begin it now.
-Johann von Goethe

When Two Hearts Race... Both Win.
-Dove Chocolate Wrapper

Chroniclemaster1, Founder of www.EarthChronicle.com
A Growing History of our Planet, by our Planet, for our Planet.