Keeping a password textbox secure

[chris128]

I've never really used the SecureString class before but I've got a requirement in an app to have a user enter a password that will be used later in the application, and I figure SecureString is the most secure way to do this.

I have created a little dialog form where the user will enter their username and password and have set the UseSystemPasswordChar property of the password textbox to True. As I need to keep the password in memory for use later though, I have created a property in my main form that is of type SecureString and when the user enters their password into the dialog window I copy the string from the password box to the SecureString property like so:

For i As Integer = 0 To LoginFrm.PasswordBox.TextLength - 1
     Me.ConnectionPassword.AppendChar(LoginFrm.PasswordBox.Text(i))
Next

I figured out how to get the original string back when I need to (with only a slight hint from the documentation I might add ), which I do like this:

Dim OriginalString As String = Marshal.PtrToStringBSTR(Marshal.SecureStringToBSTR(Me.ConnectionPassword))

but the problem I have is that I want the user to have the option to edit the password they already entered if they want to. This is a problem because I want to avoid putting the real password back into the password box for security reasons, but then if I just put some random characters in there (just to show that their password has been remembered by the app) and then the user clicks OK on the login diaog form then it will update my ConnectionPassword property and set it to the random characters.
One option would be to set the passwordbox text to something specific each time and then test to see if that is what the text is set to when they click Ok (and if it is then obviously dont update the ConnectionPassword property) but this seems pretty rubbish because its possible (however unlikely) that the user could actually select that word as a password.

Any better suggestions? Perhaps its not worth doing anything at all and just use a normal string as the SecureString is going to have to get converted back to a normal string at some point to be used...

Cheers
Chris

[sapator]

Hey.
Why don't you use the simple
"Insert original password
New password
Retype new password"
trick?

[chris128]

I guess I could but that is usually for if you are actually resetting a password - all I want to do is just get a password from the user. Perhaps I wasnt clear with my description so here's a better description of what exactly my app is doing:
The application is for removing unused user accounts from Active Directory domains and by default the application will just connect to the specified domain as the currently logged on user. This will be fine for most users of the application but some security conscious administrators may not actually be logged on to their PC as a domain admin account so using the currently logged on user may not have enough permissions to remove objects from the domain etc. So I want to give the users of the app an option to enter the username and password of an account that does have the necessary permissions, then my app will use those credentials when it connects to the domain.

[sapator]

Hm.
Ok maybe i'm not understanding correctly.Why would you need to edit a password in order to log in as another user?
Are you sort of saving an admin password behind the original password?
If the user closes the application then where does the edited password goes?
If someone change the simple user password and specifies and admin password and you save that somewhere then the next time he logs in with a simple user account he will be having admin accounts.
If all these are what you are doing and i'm not mistaken then why don't u u sql express, store an encrypted string for the admin passwords and decrypt it when p.e. a user wants to log in as admin(p.e. having a checkbox on the form to specify an administrator try of log in) and then check against his password in the textbox and the decrypted password.

[chris128]

I think you still are not understanding - there's no way I need to use an SQL database or anything like that as the application only needs to know the password whilst it is running. It is not something that will automatically run without user interaction, it is just an application that the user launches and enters their domain name and some other information (including the username/password to use to connect to the domain if necessary) and then they click a button and the app will query the domain and find accounts that match the criteria the user specified. When the application is closed, the username/password doesnt go anywhere, the user has to enter the information (including the username and password they want to use) again next time they use it.
This is a utility, not a program that someone would use every day or anything.

[sapator]

Well i'm trying to push you away from making the user edit the password, i think this is clear
So you need the user to enter the pass and the app will see if he/she is a user or admin and do accordingly.

"So I want to give the users of the app an option to enter the username and password of an account that does have the necessary permissions, then my app will use those credentials when it connects to the domain"

I guess i fail to see why you need to edit passwords.Just use what he gives you.If he provide something wrong then notify him.

Again if i don't understand sorry.Maybe i'm distracting you rather than helping but the password editing seems peculiar and i would have probably used impersonation.

[chris128]

lol no I dont want to edit the actual password.
I want the user to enter a username and password (only if they dont want to just connect to the domain as their currently logged on user account) but I don't want them to only be able to enter the username and password once and then that's it they can never change it without closing the application and opening it again. They should be able to go back and edit it or specify a completely new username and password if they want to. For example if the connection to the domain fails and they decide they want to try using a different username and password to the one they entered previously, they will need to edit the username and password - this is what I am talking about

[norman_bates]

lol no I dont want to edit the actual password.
I want the user to enter a username and password (only if they dont want to just connect to the domain as their currently logged on user account) but I don't want them to only be able to enter the username and password once and then that's it they can never change it without closing the application and opening it again. They should be able to go back and edit it or specify a completely new username and password if they want to. For example if the connection to the domain fails and they decide they want to try using a different username and password to the one they entered previously, they will need to edit the username and password - this is what I am talking about

You mean like the "run as....." feature already bundled into Windows. You can select to run as the current user or choose to select a new user/password to run as????

Disable the ability to copy the contents of the password textbox and hide the characters behind the passwordchar maybe?????

[chris128]

You mean like the "run as....." feature already bundled into Windows. You can select to run as the current user or choose to select a new user/password to run as????

Yeah basically, only in this case you wouldn't be running the entire program as another user, the program would just be connecting to the active directory domain as another user.

Disable the ability to copy the contents of the password textbox and hide the characters behind the passwordchar maybe?????

I've already done that (both of those things get done for you when you set the UseSystemPasswordChar property of a textbox to True). Its more the in memory copy of the string that I'm thinking of but to be honest I'm probably going a bit over the top on the security side of things. I'm sure most other programs that do this same sort of thing dont go to any great length to keep the password secure because its only going to be in memory whilst the program is running and the app will only be run for a few minutes.