Global variable for secure data [closed]

Question

I need a variable to which access will have different forms of my application.

In this variable I want to store a password. I want to know how best to define this variable? Through a delegate?

CSP? (But CSP for asymmetric keys, right?) Some isolated storage? or just method for example static class in Program.cs:

static class Data
{
    public static string Value { get; set; }
}

I ask this because I want to protect themselves against Trojan horses that can get access to my process, you know like ArtMoney :)

Answer 1

I'm sure you already know this, but I'll restate it just to make sure: You can't protect your app from Trojans running on the same machine. You can just make it harder for them.

That said, the SecureString class ensures that the password is in (unencrypted) memory only as short as possible, thus making it harder for another process to extract that information.

Note that reading the value stored in the SecureString is not so easy, not even for your own application. An example on how to do that can be found in this article, which converts it to a BSTR:

IntPtr bstr = Marshal.SecureStringToBSTR(password);

try
{
    // ...
    // use the bstr
    // ...
}
finally
{
    Marshal.ZeroFreeBSTR(bstr);
}

The string is deliberately not converted to a managed string, which would, again, linger around unencrypted in managed memory until it is garbage collected. The correct way would be to interact directly with the BSTR (which is zeroed out in the finally block), for example, using Marshal.ReadByte. And example can be found in this article.