If you use the System.DirectoryServices.AccountManagement.PrincipalContext constructor that takes a user name and password, that user name and (more disconcertingly) password are held internally as plain text strings in the object.
Is there a way around this obvious security risk?