Connection strings - securing/protecting

I will be using C#'s SqlConnection to connect to SQL Server. I will need connection strings, and I don't want to include passwords in my source code. In Microsoft Azure, you can save a connection string within Azure.com, and the app will automatically pick it up.

1) For connecting to a Winhost SQL Server, what's a good and simple approach?

2) I was originally interested in connecting to Azure SQL Server and other data (BLOBs, Tables) on Azure, directly from Winhost code. But I'd need to keep my password secure, both in rest and during any inital connect across the internet. It sounds dangerious. Is that true? I'm curious if someone would say, "ah, do it. no problem with security". But my guess is I shouldn't even bother looking into it. A work around would be to make API calls over https and keep all data access code in Azure.

Thanks for any insight.
Ernie