Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Why I should use SecureString over string?

Tags:

c#

.net

security

Exploring an existing project, I just came to this code. Questions came to mind is, when and why I should use SecureString over string? What are the benefits it provides?

public interface IAuthenticationService
{
    bool Login(string username, SecureString password);
}

Note: My point of interest is to simply know the additional benefits SecureString provides over string.

like image 402
Mahbubur Rahman Avatar asked Jul 25 '26 13:07

Mahbubur Rahman


1 Answers

The purpose is to avoid the password(or so called sensitive sting) to be stored in memory as plain text. That would make the application potentially vulnerable. However it could not be generally possible as the string at the end have to be transferred to plain text by framework itself. So what SecureString actually does is shortening that period when sensitive string is kept in the memory.

However it is kind a obsolete and not recommend anymore for the new development, link.

like image 101
Johnny Avatar answered Jul 27 '26 02:07

Johnny