>The call to the db server is internal. The app however is over the internet.
>
>db

If the call to the database is internal, and the config is sitting on the server, sniffing a password isn't as big of deal, if you have a secure internal network. The database is on a different server, or on the same server as the IIS, ASP.NET user is running?

Morgan