When would I need a SecureString in .NET?

by

Some parts of the framework that currently use SecureString:

The main purpose is to reduce the attack surface, rather than eliminate it. SecureStrings are “pinned” in RAM so the Garbage Collector won’t move it around or make copies of it. It also makes sure the plain text won’t get written to the Swap file or in core dumps. The encryption is more like obfuscation and won’t stop a determined hacker, though, who would be able to find the symmetric key used to encrypt and decrypt it.

As others have said, the reason you have to create a SecureString character-by-character is because of the first obvious flaw of doing otherwise: you presumably have the secret value as a plain string already, so what’s the point?

SecureStrings are the first step in solving a Chicken-and-Egg problem, so even though most current scenarios require converting them back into regular strings to make any use of them at all, their existence in the framework now means better support for them in the future – at least to a point where your program doesn’t have to be the weak link.

More Related Contents:

  1. Encrypting appSettings in web.config
  2. How to securely store a connection string in a WinForms application?
  3. Default SecurityProtocol in .NET 4.5
  4. How does SQLParameter prevent SQL Injection?
  5. .NET obfuscation tools/strategy [closed]
  6. Override Authorize Attribute in ASP.NET MVC
  7. Encrypting Connection String in web.config
  8. AES interoperability between .Net and iPhone?
  9. implement RSA in .NET core
  10. Inheritance security rules violated while overriding member – SecurityRuleSet.Level2
  11. Best way to store encryption keys in .NET C#
  12. How to build RUNAS /NETONLY functionality into a (C#/.NET/WinForms) program?
  13. Encrypting connectionStrings section – utility for app.config
  14. Secure Password Hashing [closed]
  15. How can I avoid SQL injection attacks in my ASP.NET application?
  16. How to convert SecureString to System.String?
  17. User Group and Role Management in .NET with Active Directory
  18. Given a private key, is it possible to derive its public key?
  19. WCF error: The caller was not authenticated by the service
  20. Can strong naming an assembly be used to verify the assembly author?
  21. Is “Code Access Security” of any real world use?
  22. Is it possible to encrypt data with AES (256 bit) GCM mode in .net framework 4.7?
  23. Memory randomization as application security enhancement?
  24. No AppDomains in .NET Core! Why?
  25. How to test a WPF user interface?
  26. Regex to match anything but two words
  27. What’s the purpose of the Tuple(T1)/Singleton in .net?
  28. How can I tell whether two .NET DLLs are the same?
  29. Why does BCL GZipStream (with StreamReader) not reliably detect Data Errors with CRC32?
  30. ‘Shadows’ vs. ‘Overrides’ in VB.NET

Leave a Comment