| description | ms.date | ms.topic | title |
|---|---|---|---|
Avoid Using SecureString With Plain Text |
06/28/2023 |
reference |
AvoidUsingConvertToSecureStringWithPlainText |
Severity Level: Error
The use of the AsPlainText parameter with the ConvertTo-SecureString command can expose secure
information.
Use a standard encrypted variable to perform any SecureString conversions.
If you do need an ability to retrieve the password from somewhere without prompting the user, consider using the SecretStore module from the PowerShell Gallery.
$UserInput = Read-Host 'Please enter your secure code'
$EncryptedInput = ConvertTo-SecureString -String $UserInput -AsPlainText -Force$SecureUserInput = Read-Host 'Please enter your secure code' -AsSecureString