Sensitive Dependency property values are exposed by snoop tool in WPF application, How to prevent that?

Question

I am using one user control which has it's password property. To set that password property i am using DependencyProperty created in viewmodel. When I am running application and trying to debug using Snoop tool(SnoopWpf), and when i look into user control properties it shows the password set for that control. I want to prevent snoop tool to show password property value. Is there any way we can add security to perticular dependency property?

XAML Code:

<class:MyControl x:Name="myControl" IsReadOnly="True" 
CtlPassword="{Binding myPassword, Mode=OneWay}" 
</class:MyControl> 


private static DependencyProperty PasswordProperty = DependencyProperty.Register("myPassword", typeof(String), typeof(myControl), new PropertyMetadata(null));

public String myPassword
{
     get { return (String)GetValue(PasswordProperty); }
     set { SetValue(PasswordProperty, value); }
}

I looked into this link for one of the solution - Snoop proof solution Can we add any security to this myPassword property? Which will hide this property from any debugging tool

A few notes on your dependency property declaration. First, there are naming conventations. The name of your property should start with an uppercase letter, like `MyPassword`. The property would also have to be registered with that name. The safest would be `nameof(MyPassword)` instead of the string literal `"MyPassword"`. Second, the dependency property field must be named like the property plus the `Property` postfix, i.e. `MyPasswordProperty`, and it should be declared as `public static readonly`. Finally, the third parameter to the Register call must be `typeof(MyControl)`. — Clemens, Dec 04 '17 at 14:54

score 1 · Answer 1 · answered Dec 04 '17 at 16:22

Don't store passwords in string properties. This is a big no-no if you care about security. At least use a SecureString - or don't store them at all.

There is an example of how to use a behaviour to bind the to a SecurePassword property available here:

Bind SecurePassword to ViewModel

Sensitive Dependency property values are exposed by snoop tool in WPF application, How to prevent that?

1 Answers1