Timeline for SecureString as SqlParameter value without GC concerns
Current License: CC BY-SA 3.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 17, 2015 at 14:36 | history | edited | RubberDuck |
edited tags
|
|
| Jun 4, 2015 at 21:24 | history | edited | 200_success |
edited tags
|
|
| Jun 4, 2015 at 21:13 | answer | added | RubberDuck | timeline score: 5 | |
| Apr 24, 2015 at 21:03 | comment | added | Dan Lyons | It may not ultimately store the value in a column as plain text, but your code above is passing the plain text value as a parameter to the database, which is pretty easy to capture. You could salt and hash it first, then pass the value as a SqlBinary parameter, though. | |
| Apr 24, 2015 at 19:32 | comment | added | jnm2 | The database is not storing the password. It's salting and hashing it, comparing to a saved hash, and returning a signal. | |
| Apr 24, 2015 at 17:39 | comment | added | Dan Lyons | If the string value is so sensitive that you need to take extreme steps to prevent it sitting in memory, you probably shouldn't be adding it to the database as plain text. | |
| Apr 24, 2015 at 14:20 | history | edited | 200_success |
edited tags
|
|
| Apr 24, 2015 at 13:36 | comment | added | jnm2 |
@200_success I don't think sql is a good tag for this. This has nothing to do with the language SQL or SQL Server. This is really about using a SecureString in a DbParameter, not necessarily a SqlParameter at all.
|
|
| Apr 24, 2015 at 2:39 | history | edited | 200_success |
edited tags
|
|
| Apr 23, 2015 at 15:03 | history | edited | jnm2 | CC BY-SA 3.0 |
added 8 characters in body
|
| Apr 23, 2015 at 13:04 | history | edited | jnm2 | CC BY-SA 3.0 |
added 80 characters in body
|
| Apr 18, 2015 at 17:00 | history | edited | Jamal | CC BY-SA 3.0 |
deleted 37 characters in body
|
| Apr 18, 2015 at 16:43 | review | First posts | |||
| Apr 18, 2015 at 17:00 | |||||
| Apr 18, 2015 at 16:42 | history | asked | jnm2 | CC BY-SA 3.0 |