SecretManagement VS platform-compat

Securely Store Credentials on Disk Using the new secrets manager by MS is probably one of the easier and better ways to go about this now. · https://github.com/PowerShell/SecretManagement

Looks good. Can I ask what your case is for using SecretManagement.JustinGrote.CredMan module? The license says it’s a modification of https://github.com/PowerShell/SecretManagement/tree/master/ExtensionModules/CredManStore, but the source is not available on the authors Github page for this module.

There is a PowerShell secrets module, which is presumably more secure: https://github.com/PowerShell/SecretManagement

As for the credential handling, you're on the right track. PSFalcon doesn't handle them, so you can store them however you'd like as long as they're passed to Request-FalconToken as plain text. I plan on looking into support for the SecretManagement module in a future version.

I've used the SecretManagement module from Microsoft for some time and been very happy with it.

However there are other ways to handle secret management. Microsoft, as of last year, offers the SecretManagement module that I have not messed with yet. https://github.com/PowerShell/SecretManagement

DotNet offers the SecureString class to keep a string encrypted in Memory, but as long as the OS does not natively support this concept, the only advantage is that it resides in memory for a shorter time, the disadvantage is that SecureStrings are easier to search for.

Note the KeePass's resistance to the attack mentioned depends on the security of .NET's secure string, which, here's what Microsoft has to say about it (https://github.com/dotnet/platform-compat/blob/master/docs/D...)

As for KeePassXC, last I checked it didn't even bother.

TIL. Looks like the deprecation note recommends MailKit.

Well of course, but it does have to be passed to the module that generates the hashes AD uses in the first place. And as I said, the standard password reset screen is bound to store the password in plain text somewhere as well.

This won’t help you with your question, but I figured I should warn against using send-mailmessage.

points you here.

Some of the reasons for not using Hashtable or other non-generic collection types are outlined here. That's why Microsoft doesn't recommend their usage in new implementations across all of its API documentation.

And if you really want to be secure you need to something better than a SecureString: https://github.com/dotnet/platform-compat/blob/master/docs/DE0001.md