The environment is Windows. We are using 3rd party tools in our app, and for tools to work they require method call and pass a license key that is a string.
License.Import(string name, string email, string organization, string code)
Since it is an installable Windows app that might not have access to the internet, I don't see any solution, but to store license keys 'inside' the application.
The 'standard' way of protecting from memory dumping the key in C# is using
However, when initializing
SecureString I still need to feed the actual key into it. Which means that someone could decompile the code and get the strings from there. To prevent that I could use XOR with another value to obfuscate the key, but then I would have to store the XOR value somewhere which then could be decompiled and so on...
How to go around this hide the string inside the app circularity? Or is it 'good enough' to just SecureString + XOR the key, and accept that if someone will be determined enough he will crack it no matter what?