We currently have 8 questions, one of them closed about .Net's
SecureString. I find this topic interesting and would like to follow these questions, but we don't have a tag for it. In theory, every
SecureString question could (should?) be tagged with security + memory-management + (maybe) cryptography. Following all of these tags wouldn't really allow me to easily spot out these questions though as they individually cover a much larger space.
I was going to create securestring, but it is very specific to .Net. We, as a rule, try to create language agnostic tags on this site. Is there a language agnostic concept for what
For those who may not know what
SecureString is, think of it as a way to securely pass around data, like passwords, in your program.
An instance of the System.String class is both immutable and, when no longer needed, cannot be programmatically scheduled for garbage collection; that is, the instance is read-only after it is created and it is not possible to predict when the instance will be deleted from computer memory. Consequently, if a String object contains sensitive information such as a password, credit card number, or personal data, there is a risk the information could be revealed after it is used because your application cannot delete the data from computer memory.
A SecureString object is similar to a String object in that it has a text value. However, the value of a SecureString object may use a protection mechanism, such as encryption, provided by the underlying operating system, can be modified until your application marks it as read-only, and can be deleted from computer memory by either your application or the .NET Framework garbage collector.