title: Securing a password input in c# dotnet core console app
body: <p>long time lurker here finally having a question that I'm not seeing. I am writing a c# console application in dotnet core and trying to allow a user to input a password, and am concerned about security, particularly memory dumping.</p>
  
  <p>Following: <a href="https://stackoverflow.com/questions/3404421/password-masking-console-application">Password masking console application</a> my understanding is that a <strong>password stored as a string variable could be exposed through a memory dump</strong> (<a href="https://stackoverflow.com/a/12657970/7729474">reference</a>).</p>
  
  <p>SecureString would normally be the way to go here but doesn't seem to be supported in <a href="https://github.com/dotnet/corefx/pull/3536" rel="nofollow noreferrer">dotnet core</a>.</p>
  
  <p>I've tried to modify the code to use a char array, because my limited understanding is that it is not immutable so it will not all be stored in a single piece of memory. Honestly though security is not my forte, so my question is if this code below properly protects me from exposing the password through a memory dump?</p>
  
  <pre class="lang-cs prettyprint-override"><code>        Console.WriteLine("Enter pass");
          char[] passwordArray = new char[256];
          int whileIndex = 0;
  
          while (true)
          {
              ConsoleKeyInfo key = Console.ReadKey(true);
              if (key.Key == ConsoleKey.Enter)
              {
                  break;
              }
              else if (key.Key == ConsoleKey.Backspace)
              {
                 if (whileIndex != 0) //so it doesn't explode if someone holds backspace
                  {
                      whileIndex--;
                  }
              }
              else
              {
                  passwordArray[whileIndex] = key.KeyChar;
                  whileIndex++;
              }
          }
          //Truncate array to length of password
          var endIndex = Array.IndexOf(passwordArray,'\0');
          char[] shortenedPasswordArray = new char[endIndex];
          Array.Copy(passwordArray, shortenedPasswordArray, endIndex);
  
          //Authentication code here
  
          //Wipe the characters when done
          foreach(var passChar in passwordArray)
          {
              passwordArray[passChar] = '\0';
          }
  
          foreach (var passChar in shortenedPasswordArray)
          {
              shortenedPasswordArray[passChar] = '\0';
          }
  </code></pre>