4 ms·

I suppose it's a lot more difficult to wipe memory clean in a garbage collected language. For example: password = "my-secret-password"; // do stuff th

I suppose it's a lot more difficult to wipe memory clean in a garbage collected language. For example: password = "my-secret-password"; // do stuff then remove the pass from memory password = "" or null or delete or unset We have no guarantee that the first string "my-secret-password" will be collected and removed any time soon whereas in C or C++ we could just memset it before freeing it. But that feels like a very generous interpretation, I'm sure the author really meant it as a "real programmers don't use GC language"...

sixothree 4y ago
C# has SecureString. I assume BitWarden uses this. edit: https://learn.microsoft.com/en-us/dotnet/api/system.security.securestring?view=net-7.0 https://learn.microsoft.com/en-us/dotnet/api/system.security...
- aflag 4y ago
  Interestingly, in those docs they recommend against using that class and point to this github repo explaining the reason: https://github.com/dotnet/platform-compat/blob/master/docs/DE0001.md https://github.com/dotnet/platform-compat/blob/master/docs/D...
  - piaste 4y ago
    To be pedantic, they're not saying the class is making things worse - it just doesn't do anything on .NET Core because it lacks cross-platform encryption APIs comparable to the ones used on .NET Framework. So it's basically just a String. It's a little frustrating that their only recommended alternative is "just give us your secrets bro" though: > The general approach of dealing with credentials is to avoid them and instead rely on other means to authenticate, such as certificates or Windows authentication.
  - kcartlidge 4y ago
    Nice. Less of a SecureString and more of a SlightlySmallerWindowOfInsecurityString. TIL.
- aljarry 4y ago
  There's a pretty important note in the remarks, that you should not use SecureString in new code, as it only shortens the lifespan of the plaintext in memory.
aljarry 4y ago
That's only if you use immutable strings. In C# or js (and probably in others as well) you can use some form of byte arrays / buffers, and overwrite their content after use.
- blibble 4y ago
  those references aren't real pointers though, the underlying runtime may have copied/moved around the underlying memory behind the scenes
im3w1l 4y ago
Technically C/C++ have an as-if rule (the optimizer can do whatever it wants as long as the program behaves as-if it ran the source code provided) that allows the optimizer to create cached copies and/or omit the memset. There is no way to express in C/C++ that all traces of a given variable should be removed. Though I guess there are constructs that work well enough in practice and you can always check the generated assembly.

sixothree 4y ago

C# has SecureString. I assume BitWarden uses this. edit: https://learn.microsoft.com/en-us/dotnet/api/system.security.securestring?view=net-7.0 https://learn.microsoft.com/en-us/dotnet/api/system.security...

aflag 4y ago
Interestingly, in those docs they recommend against using that class and point to this github repo explaining the reason: https://github.com/dotnet/platform-compat/blob/master/docs/DE0001.md https://github.com/dotnet/platform-compat/blob/master/docs/D...
- piaste 4y ago
  To be pedantic, they're not saying the class is making things worse - it just doesn't do anything on .NET Core because it lacks cross-platform encryption APIs comparable to the ones used on .NET Framework. So it's basically just a String. It's a little frustrating that their only recommended alternative is "just give us your secrets bro" though: > The general approach of dealing with credentials is to avoid them and instead rely on other means to authenticate, such as certificates or Windows authentication.
- kcartlidge 4y ago
  Nice. Less of a SecureString and more of a SlightlySmallerWindowOfInsecurityString. TIL.
aljarry 4y ago
There's a pretty important note in the remarks, that you should not use SecureString in new code, as it only shortens the lifespan of the plaintext in memory.

aljarry 4y ago

That's only if you use immutable strings. In C# or js (and probably in others as well) you can use some form of byte arrays / buffers, and overwrite their content after use.

blibble 4y ago
those references aren't real pointers though, the underlying runtime may have copied/moved around the underlying memory behind the scenes

im3w1l 4y ago

Technically C/C++ have an as-if rule (the optimizer can do whatever it wants as long as the program behaves as-if it ran the source code provided) that allows the optimizer to create cached copies and/or omit the memset. There is no way to express in C/C++ that all traces of a given variable should be removed. Though I guess there are constructs that work well enough in practice and you can always check the generated assembly.