储存密码的最佳方法（无数据库或纯文本）？

Question

Is there a way to store passwords securely in C# without the use of a database? I want the application to not have to rely on a database, but I do not want to store the password in plain text. For example, I currently do something like:

public static string username = "george";
public static string password = "password";

I'd like the easiest and securest way to store it otherwise. The application does not need a database for any other purpose, so I'm simply trying to avoid introducing a database for the purpose of storing only a single piece of information.

Answer 1

See SecureString , which gives you access to a variety of string manipulation while encrypting the data in memory to prevent local memory attacks.

If you're interested in the persisting of passwords, it's common to hash and then save the password, and then locally perform the same hash when a login is attempted, comparing the hashed data instead of the raw text. This way, An incorrect password is rejected, but the correct password will hash to the stored value.

As for storing the data, consider storing it as a setting .

Note that cryptography and "how to store passwords safely" is a huge subject and something you should research.