<p>I have some code like this in a winforms app I was writing to query a user's mail box Storage Quota.</p>

<pre><code>DirectoryEntry mbstore = new DirectoryEntry(
      @"LDAP://" + strhome, 
      m_serviceaccount, 
      [m_pwd], 
      AuthenticationTypes.Secure);
</code></pre>

<p>No matter what approach I tried (like <code>SecureString</code>), I am easily able to see the password (<strong>m_pwd</strong>) either using Reflector or using strings tab of Process Explorer for the executable.</p>

<p>I know I could put this code on the server or tighten up the security using mechanisms like delegation and giving only the required privileges to the service account.</p>

<p>Can somebody suggest a reasonably secure way to store the password in the local application without revealing the password to hackers?</p>

<p>Hashing is not possible since I need to know the exact password (not just the hash for matching purpose).
Encryption/Decryption mechanisms are not working since they are machine dependent.</p>

[{'answer_id': 40865, 'author': 'Steven Murawski', 'author_id': 1233, 'author_profile': 'https://Stackoverflow.com/users/1233', 'pm_score': 2, 'selected': False, 'text': '<p>If you store it as a secure string and save the secure string to a file (possibly using <a href="http://msdn.microsoft.com/en-us/library/system.io.isolatedstorage.aspx" rel="nofollow noreferrer">Isolated Storage</a>, the only time you will have a plain text password is when you decrypt it to create your mbstore.  Unfortunately, the constructor does not take a SecureString or a Credential object.</p>\n'}, {'answer_id': 40867, 'author': '1800 INFORMATION', 'author_id': 3146, 'author_profile': 'https://Stackoverflow.com/users/3146', 'pm_score': 6, 'selected': True, 'text': "<p>The sanctified method is to use CryptoAPI and the Data Protection APIs.</p>\n\n<p>To encrypt, use something like this (C++):</p>\n\n<pre><code>DATA_BLOB blobIn, blobOut;\nblobIn.pbData=(BYTE*)data;\nblobIn.cbData=wcslen(data)*sizeof(WCHAR);\n\nCryptProtectData(&amp;blobIn, description, NULL, NULL, NULL, CRYPTPROTECT_LOCAL_MACHINE | CRYPTPROTECT_UI_FORBIDDEN, &amp;blobOut);\n_encrypted=blobOut.pbData;\n_length=blobOut.cbData;\n</code></pre>\n\n<p>Decryption is the opposite:</p>\n\n<pre><code>DATA_BLOB blobIn, blobOut;\nblobIn.pbData=const_cast&lt;BYTE*&gt;(data);\nblobIn.cbData=length;\n\nCryptUnprotectData(&amp;blobIn, NULL, NULL, NULL, NULL, CRYPTPROTECT_UI_FORBIDDEN, &amp;blobOut);\n\nstd::wstring _decrypted;\n_decrypted.assign((LPCWSTR)blobOut.pbData,(LPCWSTR)blobOut.pbData+blobOut.cbData/sizeof(WCHAR));\n</code></pre>\n\n<p>If you don't specify CRYPTPROTECT_LOCAL_MACHINE then the encrypted password can be securely stored in the registry or config file and only you can decrypt it. If you specify LOCAL_MACHINE, then anyone with access to the machine can get it.</p>\n"}, {'answer_id': 48762, 'author': 'Gulzar Nazim', 'author_id': 4337, 'author_profile': 'https://Stackoverflow.com/users/4337', 'pm_score': 2, 'selected': False, 'text': '<p>I found this book by keith Brown The .NET Developer\'s Guide to Windows Security. It has some good samples covering all kinds of security scenarios.\nFree <a href="http://alt.pluralsight.com/wiki/default.aspx/Keith.GuideBook.HomePage" rel="nofollow noreferrer">Online version</a> is also available.</p>\n'}, {'answer_id': 155356, 'author': 'Michael Petrotta', 'author_id': 23897, 'author_profile': 'https://Stackoverflow.com/users/23897', 'pm_score': 4, 'selected': False, 'text': "<p>As mentioned, the Data Protection API is a good way to do this.  Note that if you're using .NET 2.0 or greater, you don't need to use P/Invoke to invoke the DPAPI.  The framework wraps the calls with the System.Security.Cryptography.ProtectedData class.</p>\n"}]
['https://Stackoverflow.com/questions/40853', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/4337/']