Who knows of the .Net Secure Strings?
[警告这不是新东西 - 但如果您需要保护应用程序中的敏感数据，则不应忽视]
“安全字符串”不是 .Net 的矛盾吗？因此，如果我们正在考虑使用 C 或 C++ 保护一些敏感数据
其相对简单的将其加载到字符数组内存中并对其进行加密，在加载信息后擦除内存。
现在用 .Net 试试吧！从微软网站：
“String 之所以称为不可变，是因为它的值一旦创建就无法修改。”
那么你怎么能摧毁一个呢？设置为空？简单地说，你不能:-)。一旦不再引用您的字符串，
或者更糟的是，您的对象包含该字符串是垃圾收集器来执行其工作的时间。问题
是如果您的对象已经存在足够长的时间以进入第 1 代或第 2 代，那么它将需要更长的时间。
嗯，如果您将密码、信用卡、加密密钥或其他一些敏感文本保存在内存中，则翻译为
一个你无法摧毁它的字符串（想想我们老歌的 memset！）。只有 GC 可以为您释放内存，而您是
取决于它如何释放该内存。我个人不知道它是否将其设置为空白，或者只是取消引用
指针。但是，我愿意打赌这是需要最少工作的选项，并且不需要
控制我们敏感数据的暴露是个好兆头。
众所周知，这很糟糕！
(
Isn’t “Secure String” an oxymoron for .Net? So if we are thinking about securing some sensitive data in say C or C++
its relatively simple load it into a char array memory and encrypt it, wiping the memory out after the information has been loaded.
Now try that with .Net! From the Microsoft site:
“A String is called immutable because its value cannot be modified once it has been created.“
So how can you destroy one? Set it to empty? Well simply put you can’t :-) . Once your string is not longer referenced,
or worse yet your object containing the string its time for the Garbage Collector to come and do its work. The problem
is if your object has been around long enough to get into Generation 1 or 2 then it is going to take a bit longer.
Hmmm so in translation if you keep a password, Credit Card, encryption key or some other sensitive text in memory as
a string you cant destroy it (think memset for us oldies!). Only the GC can free the memory for you, and you are
dependent on HOW it frees that memory. I personally don’t know for a fact if it memsets it to blank, or just dereferences
the pointer. However I would be willing to bet it is the option that requires the least amount of work and that doesn’t
bode well for controlling the exposure of our sensitive data.
Plainly that proverbially sucks!
)
页:
[1]