---
id: 8095
title: "Limiting The Exposure of Plain Text Passwords in C#"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/thick-application-pentesting/thick-application-penetration-testing-limiting-the-exposure-of-plain-text-passwords-in-c/"
published_at: "2019-10-24T00:00:00Z"
tags: ["pentesting", "secure-coding", "thick-client", "dotnet", "csharp", "securestring", "memory-exposure"]
phying_url: "https://phying.com/item/8095"
lang: en
---

# Limiting The Exposure of Plain Text Passwords in C#

## Summary

NetSPI shows why .NET SecureString still leaks passwords in memory via NetworkCredential, and demonstrates safer login handling using pinned mutable byte arrays instead of immutable strings.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2019-10-24T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/thick-application-pentesting/thick-application-penetration-testing-limiting-the-exposure-of-plain-text-passwords-in-c/
- **Phying News:** https://phying.com/item/8095