Starting process with username and password

Question

I know that you can start the process with the given username / password as follows:

var processInfo = new ProcessStartInfo { WorkingDirectory = workingDirectory, FileName = "a name", UserName = loggedUserName, Password = "password", Domain = userNameDomain, UseShellExecute = false, }; Process.Start(processInfo); 

The problem I am facing is that I do not want to write the actual password as part of the code, and the process does not start if I leave the Password attribute empty ... How can I safely start the process without revealing the password as a hard-coded string in code?

Answer 1

ProcessStartInfo.Password is not a simple string that you can write and assign to a property. You need an instance of SecureString , and SecureString cannot be created by passing a simple string to its constructor. Obviously, the OS does not have an API or method that allows an unreliable program to retrieve the password of the current user (this will be the biggest security error ever heard).

So, in my opinion, you have only one option left. Ask your user to enter the password again, and the result should be converted to SecureString

This example is an extension method for the string class that I saw here

 using System.Security; // ... public static SecureString ConvertToSecureString(this string password) { if (password == null) throw new ArgumentNullException("password"); unsafe { fixed (char* passwordChars = password) { var securePassword = new SecureString(passwordChars, password.Length); securePassword.MakeReadOnly(); return securePassword; } } } 

you can use it to convert the password entered by your user and start the process

 using(frmGetPassword fgp = new frmGetPassword()) { if(DialogResult.OK == fgp.ShowDialog()) { SecureString ss = fgp.Password.ConvertToSecureString(); var processInfo = new ProcessStartInfo { WorkingDirectory = workingDirectory, FileName = "a name", UserName = loggedUserName, Password = ss, Domain = userNameDomain, UseShellExecute = false, }; Process.Start(processInfo); } } 

Answer 2

I use the Windows password store to manage such passwords. Check out the http://credentialmanagement.codeplex.com/ library, which wraps around the windows API. Either your Setup-Routine or Admin can add a password to the repository, which can then be retrieved at runtime from the application. The only drawback is that the storage is user dependent. You cannot create a password that can be used for multiple users.

It is so simple:

  _credentials = new CredentialSet("myApp:*"); if (_credentials.Count == 0) { //TODO: ask user for password, supply it here, or use windows UI to set password (rundll32.exe keymgr.dll, KRShowKeyMgr) var c = new Credential() { Target = "myApp:Production", Username = "SomeUser", Description = "Credentials for doing something...", PersistanceType = PersistanceType.LocalComputer, Type = CredentialType.DomainPassword }; c.Save(); _credentials.Add(c); }