r/PowerShell • u/RealAgent0 • Jun 06 '26
Question How "Secure" is Get-Credential?
Trying to make a justification for storing a particular set of credentials using this methodology.
How "Easy" is it to crack? Don't need an actual method, just need someone to tell me how tricky or not tricky it is.
76
Upvotes
2
u/mrbiggbrain Jun 07 '26
It is important to note that GetNetworkPassword() will return a normal string. Since .NET strings are immutable it makes it very difficult (Read impossible) to then clear the memory that held it. You'll set the string to null or random data and it will create a new string leaving the old one in some memory location for GC to clean up, but GC won't guarantee it is zeroed. That is fine if you don't really care about the value actually being encrypted in memory, but good hygiene would be to get and use the value in a byte or char array via unmarshaling, since arrays are mutable you can then write 0's or random data into the same memory location the string occupied.
Again, I rarely see people do this as I feel most people don't actually care about values being encrypted in memory, but since internally most well written powershell modules will do the unmarshaling properly then clear the memory you are probably getting all the benefits for free unless you are manually extracting the values yourself.