#978 – Use a SecureString Object to Store Confidential Text Data

There can be security issues with storing confidential data in the System.String type, given that the string exists in plaintext in memory and you can’t explicitly control the amount of time during the string is present in memory.

The SecureString class provides a more secure way of storing confidential string data in memory.  SecureString is more secure than the String data type because:

• It stores the string data in memory in an encrypted form
• The encrypted data is stored in unmanaged memory and therefore not visible to the garbage collector
• It allows appending, inserting or removing characters, but re-encrypts the data after modifying it
• It is mutable, avoiding the need to create extra copies when modifying the secure string
• It zeros out the contents of the string when the SecureString object is disposed (or finalized)