Powershell: SecureString shouldn't be used warning.

[Kriegel]

In the SecureString Class documentation, there is a Warning from the platform-compat team, that Securestring shouldn't be used.
Direct Link to the Warning on Github

I like and used SecureString much in the past.

How do we deal with that?

[iSazonov]

We have to use SecureString for backward compatibility (scripts and public API).

[Kriegel]

I am aware of removing SecureString is a breaking change.
So since PowerShell is running on non Windows systems, which perhaps doesn't support SecureString encryption.
I think we have to talk about to implement user warnings, either into the documentation and on screen!?
See also in the docs #4985

[vexx32]

I believe this will be addressed during implementation of @SteveL-MSFT's proposal for secrets handling which is currently in the RFC stage. 🙂

https://github.com/PowerShell/PowerShell-RFC/pull/208

[SteveL-MSFT]

@vexx32 yes and no. The SecureString type still exists and we need it to tell PowerShell when to prompt masked input. The Secrets Management module is more about not having plaintext secrets in scripts and also abstracting remote vaults (like Azure KeyVault) making them seamless to use.

[msftbot[bot]]

This issue has been marked as answered and has not had any activity for 1 day. It has been closed for housekeeping purposes.