#953 – Use a SecureString Object to Store Confidential Text Data

There can be security issues with storing confidential data in the System.String type, given that the string exists in plaintext in memory and you can’t explicitly control the amount of time during the string is present in memory.

The SecureString class provides a more secure way of storing confidential string data in memory.  SecureString is more secure than the String data type because:

  • It stores the string data in memory in an encrypted form
  • The encrypted data is stored in unmanaged memory and therefore not visible to the garbage collector
  • It allows appending, inserting or removing characters, but re-encrypts the data after modifying it
  • It is mutable, avoiding the need to create extra copies when modifying the secure string
  • It zeros out the contents of the string when the SecureString object is disposed (or finalized)

About Sean
Software developer in the Twin Cities area, passionate about .NET technologies. Equally passionate about my own personal projects related to family history and preservation of family stories and photos.

6 Responses to #953 – Use a SecureString Object to Store Confidential Text Data

  1. michaelgoldshteyn says:

    I am not sure where you got the idea that the encrypted data is stored in unmanaged memory (your bullet #2). It can certainly be marshalled into unmanaged memory in order to read it as plaintext, but as far as I can tell it’s still on the managed heap.

  2. michaelgoldshteyn says:

    I should also mention that the last three items (#951-#953) have veered away from WPF into “2,000 Things You Should Know About C#” territory. It would be nice if the “blog train” was directed back on its WPF course going forward, since you are doing a great service to the WPF community.

  3. Pingback: Dew Drop – November 19, 2013 (#1669) | Morning Dew

  4. Pingback: #954 – Store Confidential Data Only Within SecureString Instances | 2,000 Things You Should Know About WPF

  5. Pingback: #956 – PasswordBox Stores Password as a SecureString | 2,000 Things You Should Know About WPF

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: