4 ms·
C# has SecureString. I assume BitWarden uses this. edit: https://learn.microsoft.com/en-us/dotnet/api/system.security.securestring?view=net-7.0 https://learn.m
by sixothree 4y ago
C# has SecureString. I assume BitWarden uses this.
edit: https://learn.microsoft.com/en-us/dotnet/api/system.security.securestring?view=net-7.0 https://learn.microsoft.com/en-us/dotnet/api/system.security...
- aflag 4y agoInterestingly, in those docs they recommend against using that class and point to this github repo explaining the reason: https://github.com/dotnet/platform-compat/blob/master/docs/DE0001.md https://github.com/dotnet/platform-compat/blob/master/docs/D...
- piaste 4y agoTo be pedantic, they're not saying the class is making things worse - it just doesn't do anything on .NET Core because it lacks cross-platform encryption APIs comparable to the ones used on .NET Framework. So it's basically just a String. It's a little frustrating that their only recommended alternative is "just give us your secrets bro" though: > The general approach of dealing with credentials is to avoid them and instead rely on other means to authenticate, such as certificates or Windows authentication.
- kcartlidge 4y agoNice. Less of a SecureString and more of a SlightlySmallerWindowOfInsecurityString. TIL.
- aljarry 4y agoThere's a pretty important note in the remarks, that you should not use SecureString in new code, as it only shortens the lifespan of the plaintext in memory.