How to: Use strings in a secure manner with SecureString class

Why not join our community?, there are 17 users online

home
tips & tricks
view story

DotNetKick.com is an open-source project. Please report any bugs and let us know your great suggestions. Currently running svn revision 620 (rss)

Kick Spy!, Kick Zeitgeist and Kick Widgets

25
kicks

kick it

How to: Use strings in a secure manner with SecureString class

published 6 months, 6 days ago, submitted by eugenciuta 6 months, 6 days ago

dotnetfacts.blogspot.com — The classic System.String type doesn’t provide enough security for storing sensitive data like passwords, credit card numbers or personal information. If a String object contains sensitive information, there is a risk the information could be revealed after it is used because your application cannot delete the data from computer memory. Starting with the .NET Framework 2.0 the SecureString class is available. It was designed to provide encryption for sensitive data and other useful functions.

2 comments | category:

Tips & Tricks | Views: 14 | Get KickIt image code

tags: Security, C#, Tips, Strings, SecureString | tag it

Everyones tags:

Your tags:

Please login or signup.

Add a live kick counter to your blog >> liveImage

You can even customize the image by choosing your own colors, and then clicking the button below to update the preview and the html code:

"Kick It" text
"Kick It" background
kick count text
kick count background
border

Simply copy and paste this HTML into your blog post.

Users who kicked this story:

eugenciuta -

SuperJason -

rimsystems - PeterRitchie -

yesthatmcgurk -

Obishawn -

Jemm -

boki -

mdopp - senfo -

rprouse - rpatterson -

CVertex -

jonas -

gavinjoyce -

j.monty -

drugarce - gsbell -

diamondz - Zero3 -

stupid - happer -

xtremebiz - vertigo - Tr3v

Comments:

i had no idea this existed, and i just wrote a damned payment system

posted by

CVertex 6 months, 6 days ago

Anybody attacking a .NET product will do it by attaching a debugger, so this is all pretty pointless.

Since the key and the ciphertext is in memory, they can just use your own code to decrypt it.

posted by alunharford 6 months, 5 days ago