Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>If you just want to store the string for a short period of time in memory, you can take a look at <a href="http://msdn.microsoft.com/en-us/library/system.security.securestring.aspx" rel="nofollow noreferrer">System.Security.SecureString</a>.</p> <p>Taken from this <a href="https://stackoverflow.com/questions/122784/hidden-net-base-class-library-classes#123141">answer</a>:</p> <blockquote> <p>SecureString values are stored encrypted (obfuscated, rather), but most importantly, they are never swapped to disk and can be disposed of immediately when you're done with them.</p> <p>They're tricky to use because you can only build them one character at a time (to encourage you to build them by capturing keystrokes as the user types their password), and require three lines of code to recover and then wipe their plain text, but when used properly they can make a program more secure by avoiding the virtual-memory vulnerability.</p> <p>At the end of the example the SecureString is converted into a regular managed string, which makes it vulnerable again (be sure to use the try-catch-finally pattern to Zero the string after you're done with it). SecureString's use is in reducing the surface-area of attack by limiting the number of copies the Garbage Collector will make of the value, and reducing the likelihood of being written to the swap file.</p> </blockquote> <pre><code>// Make a SecureString SecureString sPassphrase = new SecureString(); Console.WriteLine("Please enter your passphrase"); ConsoleKeyInfo input = Console.ReadKey(true); while (input.Key != ConsoleKey.Enter) { sPassphrase.AppendChar(input.KeyChar); Console.Write('*'); input = Console.ReadKey(true); } sPassphrase.MakeReadOnly(); // Recover plaintext from a SecureString // Marshal is in the System.Runtime.InteropServices namespace try { IntPtr ptrPassphrase = Marshal.SecureStringToBSTR(sPassphrase); string uPassphrase = Marshal.PtrToStringUni(ptrPassphrase); // ... use the string ... } catch { // error handling } finally { Marshal.ZeroFreeBSTR(ptrPassphrase); } </code></pre>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload