title: When would I need a SecureString in .NET?
body: <p>I'm trying to grok the purpose of .NET's SecureString.  From MSDN:</p>
  <blockquote>
  <p>An instance of the System.String class is both immutable and, when no longer needed, cannot be programmatically scheduled for garbage collection; that is, the instance is read-only after it is created and it is not possible to predict when the instance will be deleted from computer memory. Consequently, if a String object contains sensitive information such as a password, credit card number, or personal data, there is a risk the information could be revealed after it is used because your application cannot delete the data from computer memory.</p>
  <p>A SecureString object is similar to a String object in that it has a text value. However, the value of a SecureString object is automatically encrypted, can be modified until your application marks it as read-only, and can be deleted from computer memory by either your application or the .NET Framework garbage collector.</p>
  <p>The value of an instance of SecureString is automatically encrypted when the instance is initialized or when the value is modified. Your application can render the instance immutable and prevent further modification by invoking the MakeReadOnly method.</p>
  </blockquote>
  <p>Is the automatic encryption the big payoff?</p>
  <p>And why can't I just say:</p>
  <pre><code>SecureString password = new SecureString(&quot;password&quot;);
  </code></pre>
  <p>instead of</p>
  <pre><code>SecureString pass = new SecureString();
  foreach (char c in &quot;password&quot;.ToCharArray())
      pass.AppendChar(c);
  </code></pre>
  <p>What aspect of SecureString am I missing?</p>