Hi All,
I have a little project where I need to get a password from a user. I did search the forum for the solution and there seem to be just 2 answers.
1. It is impossible to bind to Password property as it was kept by Microsoft as CLR property for security reasons, to avoid easy access to plain text password.
2. The second solution uses attached property as workaround to allow binding.
The arguments why Password property is not dependency property are pretty clear.
For the second option however I couldn't find anything mentioned about any introduced security risks. For example this article Pete O'Hanlon says that his solution is OK when there is no need for security however without any more details (and there are more articles like this). I am no security expert and I would like to understand more about the issue.
Q1. My thinking is that if the solution with attached property was secure Microsoft would have implemented it within the framework. Or is there something more to it?
Q2. What is the correct secure way to handle passwords from PasswordBox in MVVM (with or without breaking the pattern)?
Q3. What are the disadvantages\risks of using attached property solution?