title: How is SecureString "encrypted" and still usable?
body: <p>According to MSDN <a href="http://msdn.microsoft.com/en-us/library/system.security.securestring.aspx">SecureString</a> contents is <em>encrypted</em> for additional safety so that if the program is swapped to disk the string contents can't be sniffed.</p>
  
  <p>How is such encryption possible I wonder? The algorithm would be fixed and therefore either well-known or deductible (say one of seven widely used in industry algorithms) and there must be a key somewhere in the program. So the attacker could fetch the encrypted string, fetch the key and decrypt the data.</p>
  
  <p>How can such encryption be useful?</p>