0

I've read about SecureString class and read a lot of different opinions about it.

And at this point, I really not sure how to use it correctly in WPF apps.

The problem is at the login. I have:

public SecureString MyPassword
{
    get => _myPassword;
    set => Set(ref _myPassword, value);
}

Now scenario:

A User enters his password and sees -> *****
A user wants to see his password in plain text, so he presses 'show password' button. 
BAM! user password is exposed in memory.

My question is: How to avoid Password exposure at this point? Is there a correct way to do "Show Password" functionality?

Nikas Žalias
  • 1,594
  • 1
  • 23
  • 51
  • 1
    Does this answer your question? [C# / WPF Unmask password inside the passwordBox](https://stackoverflow.com/questions/31040510/c-sharp-wpf-unmask-password-inside-the-passwordbox) – pix Feb 12 '20 at 07:48
  • 2
    I'm not a security expert but is there really that much of a difference if it's in memory when you're already displaying on the screen? – Loocid Feb 12 '20 at 07:49
  • what about kernel interruption each time your fingers hit the keyboard? :p sorry kidding. – pix Feb 12 '20 at 07:50
  • @pix That question does not help! I know how to unmask password, I don't know how to unmask it so it would not stay in memory. – Nikas Žalias Feb 12 '20 at 07:54
  • 1
    It is recommended that you do not use `SecureString` for new development. Here is a [link](https://github.com/dotnet/platform-compat/blob/master/docs/DE0001.md), and here is a [docs](https://learn.microsoft.com/en-us/dotnet/api/system.security.securestring?view=netframework-4.8#remarks) – vasily.sib Feb 12 '20 at 07:54
  • @Loocid Yes there is a difference. You can show password in plain text then turn off plain text and show masked again, but after that password is stored in RAM and at this point it is bad. – Nikas Žalias Feb 12 '20 at 07:55
  • 2
    There is no fool proof way of doing this. no matter what you do. you could gc.collect or store your unsecure string in a byte* and overwrite, or any other way. it doesn't stop key loggers, or screen capture, or someone standing over your should with a phone, or any number of malware. if someone is going to dump your memory for your password,then they are likely to use 1 of 100 other methods to thwart your security – TheGeneral Feb 12 '20 at 07:59
  • 1
    Client-side, every webpage you log in on stores your password as plaintext. If you're worried about security to the point of being scared that someone might read your memory, you should explore other ways of authenticating. – Kilazur Feb 12 '20 at 08:08

0 Answers0