Serialization using C #

Question

Can serialization be used as a safe means of storing program state?

Answer 1

No. Serialization is simply a technology that allows you to convert representations of objects of objects or graphs in memory into a stream of bytes, which later (with type definitions) will be restored back to the memory representation in memory of the same objects. If you want some kind of security, you can encrypt the byte stream before you save (store) it on disk or in the database, and then decrypt it again before de-serializing it, but the Serialzation / Deserialization process itself provides security.

Answer 2

Good excerpt from Wikipedia:

, , . , . .

, , , . , , .

, , ?

http://code.google.com/apis/protocolbuffers/docs/faq.html

Protobuf-net

: Jon Skeet # ( Java, ...)

Answer 3

+1 @Charles.

If you save application settings for each user, you should use a class ProtectedDatafrom the namespace System.Security.Cryptographyto reliably store serialized data; use the DataProtectionScope.CurrentUserdata area for each user.

The class ProtectedDataencrypts the data using the password for user login; The base DPAPIcode handles password changes, so data may be available.