Question

I saw this thread :

When would I need a SecureString in .NET?

the code there is :

SecureString password = new SecureString("password");

vs

SecureString pass = new SecureString();
foreach (char c in "password".ToCharArray())
    pass.AppendChar(c);

And I do understand the benefits of the second one ( adding char by char) – so that the hacker will not be able to track all chars which in random places in memory ( vs one string in mem which he can find).

The Part which I dont understnad is that part :

that yellow code is deferentially in memory !

so … where is the benefit ?

Answer 1

The 2nd code sample with ToCharArray() just demonstrates the restricted way for filling a securestring. It is not a sample of a (best) practice.

The thread you link to provides most of the answers: Securestring provides a partial solution to avoiding plain-text passwords (in memory). Not a complete solution.

But take these 2 points from the accepted answer:

• WPF’s PasswordBox control keeps the password as a SecureString internally.
• System.Diagnostics.ProcessInfo’s Password property is a SecureString.

Together they would allow you to safely transfer a password to a process.