I want to clear "immutable" string contents!

From: cppdev (cppdev9_at_yahoo.com)
Date: 08/19/03 

Date: 19 Aug 2003 12:00:37 -0700

Hi All!

I want to clear the string contents from sensitive information
such as passwords.

It's always the case that password will appear as string at some point
or another. And i feel uneasy leaving it hanging in memory indefinitely
(especially in case when string is Interned).

So at least for the case when string is not interned can we do:

string pass = Console.ReadLine();
if (string.IsInterned(pass) == null)
{
   unsafe
   {
      fixed(void* pv = pass)
      {
         char* pb = (char*)pv;
         for(int i =0; i < pass.Length; ++i)
         pb[i] = '0';
      }
   }
}
Console.WriteLine(pass);

Note: explicit RuntimeHelpers.OffsetToStringData is not needed.

What do you all think about this? It does appear to work!

Relevant Pages

  • Re: Securing my app with serial number
    ... The app has two passwords hard-coded into it, we'll call them A and B. ... It then encrypts that string with password A, ... and stores it in the registry as a challenge code. ... I can also insert some extra data into the beginning of unlock code ...
    (microsoft.public.dotnet.languages.vb)
  • Re: Securing my app with serial number
    ... The app has two passwords hard-coded into it, we'll call them A and B. ... It then encrypts that string with password A, ... and stores it in the registry as a challenge code. ... I can also insert some extra data into the beginning of unlock code ...
    (microsoft.public.dotnet.languages.vb)
  • Re: Securing my app with serial number
    ... The app has two passwords hard-coded into it, we'll call them A and B. ... It then encrypts that string with password A, ... and stores it in the registry as a challenge code. ... I can also insert some extra data into the beginning of unlock code ...
    (microsoft.public.dotnet.languages.vb)
  • Re: Random String for passwords
    ... Dim pw As New Collection ... Dim Buffer As String ... ' Set up buffer to recieve passwords. ...
    (microsoft.public.vb.general.discussion)
  • Re: Encoding difference in Vista breaks my app :(
    ... i'll have to keep the code operational because i can't re-encode the passwords with a correct algorithm, ... according to the SDK, UTF8Encoding.GetString "Decodes a sequence of bytes into a string", which is what i want, and it has worked correctly for years except for this new platform difference between Vista and previous windows versions. ... binary data, which is unlikely to be a valid UTF-8 encoded string. ...
    (microsoft.public.dotnet.framework.clr)
Quantcast