#953 – Use a SecureString Object to Store Confidential Text Data
November 19, 2013 6 Comments
There can be security issues with storing confidential data in the System.String type, given that the string exists in plaintext in memory and you can’t explicitly control the amount of time during the string is present in memory.
The SecureString class provides a more secure way of storing confidential string data in memory. SecureString is more secure than the String data type because:
- It stores the string data in memory in an encrypted form
- The encrypted data is stored in unmanaged memory and therefore not visible to the garbage collector
- It allows appending, inserting or removing characters, but re-encrypts the data after modifying it
- It is mutable, avoiding the need to create extra copies when modifying the secure string
- It zeros out the contents of the string when the SecureString object is disposed (or finalized)
About Sean
2,000 Things You Should Know About WPF 
I am not sure where you got the idea that the encrypted data is stored in unmanaged memory (your bullet #2). It can certainly be marshalled into unmanaged memory in order to read it as plaintext, but as far as I can tell it’s still on the managed heap.
SecureString stores the encrypted data on the unmanaged heap, allocating a BSTR for the buffer using SysAllocStringLen. See SafeBSTRHandle.Alloc method, called by private SecureString.AllocateBuffer method.
http://referencesource.microsoft.com/netframework.aspx
I should also mention that the last three items (#951-#953) have veered away from WPF into “2,000 Things You Should Know About C#” territory. It would be nice if the “blog train” was directed back on its WPF course going forward, since you are doing a great service to the WPF community.
Pingback: Dew Drop – November 19, 2013 (#1669) | Morning Dew
Pingback: #954 – Store Confidential Data Only Within SecureString Instances | 2,000 Things You Should Know About WPF
Pingback: #956 – PasswordBox Stores Password as a SecureString | 2,000 Things You Should Know About WPF