title: Is there any benefit to using SecureString in ASP.NET?
body: <p>If I understand correctly, this is for keeping plain text out of memory, so that the app is secure against esoteric attacks on memory, the garbage heap, or memory paged to disk. The SecureString is fed unmanaged bytes and consumed one unmanaged byte at at time--then the string is erased from memory. (Correct me if I way off!)</p>
  
  <p>In ASP.NET, the secret is collected in a webform, which post back in HTTPS. But then the Request object turns all the request values from the form into name value pairs and puts them in a collection, e.g. Request["TxtPassword"]-- so even before I can get the string, it's already been written insecurely to memory.  Worse, if I was using a control, then the unsecure representation will have more managed strings in the property of the TextBox.</p>
  
  <p>To do anything with this SecureString I need an API that takes unmanaged strings--so it seems I can't use the secure string for a stored proc parameter or much else.</p>
  
  <p>Am I doing this wrong or is it a fool's errand to try to use SecureString and not leak copies of the unsecured string into managed memory?</p>
  
  <p>Switching to OAuth or Windows auth isn't an option.</p>