C #: request user for password which is then stored in SecureString

Question

In the small application that I am currently developing for the client, I need to ask the user his username, password and user domain, and then use those who have System.Diagnostics.Process.Start to launch the application.

I have a text box with UseSystemPasswordChar to mask the entered password.

I need System.Security.SecureString to feed the password to System.Diagnostics.Process.Start .

How to convert the entered text to a protected string without making it one character after another? Alternatively: is there a better window control to ask the user for a password that returns the entered text as SecureString?

Answer 1

Try finding a custom SecurePasswordTextBox . Are you trying to do something like a Run As command, when you try to start a process as a different user than the one currently logging in? If not, you should just call Process.Start and let it get the current user credentials.

Also pay attention to the following resources:

• CredUIPromptForCredentials
• CredUIPromptForWindowsCredentials (Vista and Server 2008)
• Microsoft Support Article
• LogonUser Function
• LogonUserEx Function
• CreateProcessAsUser
• CreateProcessWithLogonW
• CreateProcessWithTokenW

The best option would probably be to use some interop p / inovke code to call CredUIPromptForCredentials to display the standard Windows dialog box, and then use this information to call Process.Start or, moreover, call the CreateProcessAsUser function.

Answer 2

The reason SecureString wants to accept one character at a time is because otherwise you will have a whole line before that and put the line into memory. Thus, using SecureString in this scenario means hitting the target.