Storing non volatile flag securely

[galapogos]

Hi,

I have an application that requires user authentication either via a password, or via a smart card authentication(PIN + smart card) before the application can be accessed.

I'm wondering how I can switch between these 2 modes. I supposed I'd need some flag to keep track of the mode, and it needs to be non-volatile so it will have to be written to the disk, but if I just write it raw in the clear, the user can easily overwrite it to override the mode.

[olivthill2]

You can encrypt your data before writing them in a file, and decrypt them when you read them.

Or you can avoid using a file, if you have a hidden read-only field that you pass from the client to the server back and forth in each new page as long as the user is logged on.

If you write applications for internet, this is the same as having a cookie or as using a session.