Timeline for Would it be good secure programming practice to overwrite a "sensitive" variable before deleting it?
Current License: CC BY-SA 4.0
20 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| S Dec 26, 2020 at 11:02 | history | suggested | Pang | CC BY-SA 4.0 |
Fixed dead links [6] and [7].
|
| Dec 26, 2020 at 4:29 | review | Suggested edits | |||
| S Dec 26, 2020 at 11:02 | |||||
| May 23, 2017 at 12:40 | history | edited | CommunityBot |
replaced http://stackoverflow.com/ with https://stackoverflow.com/
|
|
| Dec 6, 2014 at 21:06 | history | edited | makerofthings7 | CC BY-SA 3.0 |
deleted 9 characters in body
|
| Dec 5, 2014 at 9:39 | comment | added | deworde | I feel like what we've established in these comments is that computers are hard to "outwit" | |
| Dec 5, 2014 at 8:57 | comment | added | David Z |
@raptortech97 does volatile actually ensure that though? Suppose a process is suspended and its memory paged out before the sensitive variable can be overwritten, then it's later resumed. There's no guarantee the virtual memory will be paged back into the same section of physical memory, is there? In such a case volatile doesn't guarantee an overwrite. I think. I'm honestly not sure though. (volatile prevents certain compiler optimizations, I get that, but it seemed like you were saying it does more than that)
|
|
| Dec 5, 2014 at 1:48 | comment | added | raptortech97 | I think you'd definitely want the volatile keyword to make sure that what happens is actually an overwrite | |
| Dec 4, 2014 at 19:35 | comment | added | Desthro | @LieRyan shows how old my programming knowledge is ;) | |
| Dec 4, 2014 at 17:37 | comment | added | Lie Ryan | @Desthro: Unless you're working in real mode (i.e. you're writing an OS kernel), pointers are typically only virtual memory address; only the kernel has access to real memory addresses. It is certainly possible for the operating system to move the two memory pages to a different real address when the memory is overwritten, this can be done without changing the virtual address. This happens during swapping for example. | |
| Dec 4, 2014 at 17:36 | history | edited | makerofthings7 | CC BY-SA 3.0 |
edited body
|
| Dec 4, 2014 at 17:24 | history | edited | makerofthings7 | CC BY-SA 3.0 |
deleted 11 characters in body
|
| Dec 4, 2014 at 17:13 | history | edited | makerofthings7 | CC BY-SA 3.0 |
added 260 characters in body
|
| Dec 4, 2014 at 17:13 | vote | accept | Jonathan | ||
| Dec 4, 2014 at 17:06 | history | edited | makerofthings7 | CC BY-SA 3.0 |
added 260 characters in body
|
| Dec 4, 2014 at 17:01 | history | edited | makerofthings7 | CC BY-SA 3.0 |
added 260 characters in body
|
| Dec 4, 2014 at 17:01 | comment | added | Desthro | @lawtonfogle Pointers are typically memory addresses, so any data you write via the pointer goes into that address space. Though that is an interesting idea. Your method described below isn't quite the same thing as using a pointer. | |
| Dec 4, 2014 at 16:52 | comment | added | Lawtonfogle | Assuming that overwriting it actually overwrites it, and doesn't just move the pointer to some new section of memory with the new values (which means the old data sticks around until the memory is reused, just like with deleting it). | |
| Dec 4, 2014 at 16:35 | comment | added | Desthro | Though it is also possible to view the contents of a program's memory space during its operation. Deleting of memory just removes the pointer to the memory (much like the deletion of a file removes the file pointer to the file from the filesystem) Overwriting it helps keep it "secure." | |
| Dec 4, 2014 at 16:33 | comment | added | Rory Alsop♦ | The question was about overwriting first and then deleting. Can you add to your answer? | |
| Dec 4, 2014 at 16:26 | history | answered | makerofthings7 | CC BY-SA 3.0 |