[RESOLVED] Using a SecureString

[Kasracer]

After you set the contents of a SecureString, how do you extract them?

I've searched high and low and many people said you can extract the contents, however, it's not well known but none of them stated how to do so. ToString() just return "System.Security.SecureString"

Any suggestions?

[Mike Hildner]

You can get at it using the marshaller:

            SecureString password = new SecureString();
            password.AppendChar('x');
            password.AppendChar('y');
            password.AppendChar('z');

            IntPtr bstr = Marshal.SecureStringToBSTR(password);

            byte b = 1;
            int i = 0;

            // Loop through until we hit the string terminator '\0'
            while (((char)b) != '\0')
            {
                b = Marshal.ReadByte(bstr, i);
                Console.Write((char)b);
                i = i + 2;  // BSTR is unicode and occupies 2 bytes
            }

            Marshal.ZeroFreeBSTR(bstr);

Mike

[wossname]

SecureStrings not all that secure after all then

[Mike Hildner]

SecureStrings not all that secure after all then

You're right, they're not 100% secure, but I guess nothing is. SecureString is more secure than a regular string, because they're pinned and encrypted, but effectively they just reduce the exposure and not eliminate it.

Mike