Home/ Questions/Q 48529
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-10T16:17:39+00:00

One of the feature requests I’ve got for the program I’m working on is

  • 0

One of the feature requests I’ve got for the program I’m working on is to be able to save the list of credentials users enter in, so they can be shared around. The specific use case that inspired this request was using our program on a large corporate network, made up of fairly good LANs connected by a flaky WAN. The idea was that, instead of having our program beat against the WAN when it’s down, they’d send a ‘configuration’ file containing the closely-guarded admin credentials, run it in each LAN and zip up the results and e-mail it back.

Yeah.

My initial instinct is to scoff at this request – saving passwords? really? and surely the network division of the company would prefer you to try and sell whatever WAN products they have – but it turns out one of the classes I use the credentials for can take a SecureString, and, well, it’s always good to look out for ways you can save people some effort. That got me to wondering:

Is it possible to save an encrypted SecureString, so that I can save the sensitive data to a file and open it up someplace else?

What are your thoughts, Stack Overflow?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. There is no save support in SecureString, it’s intended as a mechanism to protect a in-memory managed string and is only used for interfacing with unmanaged APIs. If a password was stored in a System.String instance, security would be less due to the nature of System.String. The existence of garbage collection and interning would keep the password in memory longer than necessary. Also due to the plethora of great debugging tools for .NET, it would be significantly easier to access the string through reflection or another .NET API even without the longer lifetime.

    If you’re going to save a password on the disk your security is pretty far compromised. If someone has physical access to the machine, or administrator level remote access, then the best you can do is make it more difficult, but never impossible. Use an encryption API, store it in a secure location, configure access rights.

    All that aside, Merus, I’d suggest you try to improve the overall system because for a use-case like you’re describing (assuming I understand it) you’d be better served to store a hash than the actual password.

    • 0