title: C# ensuring shuffled memory allocation for elements in List<T>
body: <p>Most of the answers here about memory allocation in managed environment say "You don't need to bother with such things, let the platform handle it". Truth is in some cases you DO need to worry about such things.
  I have a list of objects, which, in case of memory dump, I do not want to be allocated sequentially on a straight row of consecutive addresses. I want them scattered.
  Is there any way (a trick or hack will do) to ensure objects are not allocated sequentially, and can not be recognized as a sequence in a memory dump?
  Thank you!</p>
  
  <p><strong>EDIT:</strong> The reason for this is that I'm trying to circumvent the way MySQL for .NET requires me to pass sensitive data as a connection string. My idea was to keep everything in a scattered char list, then assemble it before connection.Open(), and dispose of it immediately after. Is there a better way? I'd rather not keep database credentials in memory like that.</p>
  
  <p><strong>CONCLUSION:</strong> It seems impossible to protect sensitive data from memory dump by scattering it. In my specific case, I'll be using SecureString where I can, and will be looking for other ways to not expose unencrypted passwords to MySQL. </p>
  
  <p><strong>UPDATE:</strong> After some digging around, this is what I ended up doing: All my SQL is executed by local service, with account restricted to stored procedures and localhost. In order to request the SP call, clients have to authenticate via SHA512 hashed password + salt. On the client, the password is read char by char from the textbox, and appended onto a Secure String, then text is replaced with system pass char. Then the Secure String is hashed and the original data is zeroed out, like this:</p>
  
  <pre><code>public static string GetSHA512(SecureString secureInput)
      {
          if (secureInput == null)
              throw new ArgumentNullException("securePassword");
  
          IntPtr unmanagedString = IntPtr.Zero;
          byte[] dataUnmanaged = new byte[secureInput.Length];
          try
          {
              unmanagedString = Marshal.SecureStringToGlobalAllocAnsi(secureInput);
              Marshal.Copy(unmanagedString, dataUnmanaged, 0, dataUnmanaged.Length);
  
              using (SHA512 shaM = new SHA512Managed())
              {
                  byte[] hash = shaM.ComputeHash(dataUnmanaged);
                  int i = 0;
                  while (i &lt; dataUnmanaged.Length)
                  {
                      dataUnmanaged[i] = 0;
                      i++;
                  }
                  StringBuilder hex = new StringBuilder(hash.Length * 2);
                  foreach (byte b in hash)
                      hex.AppendFormat("{0:x2}", b);
                  return hex.ToString();
              }
          }
          finally
          {
              int i = 0;
              while (i &lt; dataUnmanaged.Length)
              {
                  dataUnmanaged[i] = 0;
                  i++;
              }
              Marshal.ZeroFreeGlobalAllocAnsi(unmanagedString);
          }
      }
  </code></pre>
  
  <p>The resulting hash is further hashed with a random salt and sent to the service for confirmation along with the salt. Service re-hashes its hashed pass with the salt and compares. Once approved, further authentication happens via constantly changing unique session IDs that both the client and the server track. Any hijacking and the session is immediately invalidated. That way the password is used only once, transferred only double-hashed, and stored in a SecureString for as short a time as possible.
  This is the best I could come up with. I'll update further if something new pops up, thanks to everybody.</p>