Timeline for Is it more secure to overwrite the value char[] in a String
Current License: CC BY-SA 3.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 19, 2019 at 11:49 | answer | added | de-jcup | timeline score: 1 | |
| S Dec 15, 2014 at 8:07 | history | bounty ended | Serverfrog | ||
| S Dec 15, 2014 at 8:07 | history | notice removed | Serverfrog | ||
| S Dec 13, 2014 at 21:52 | history | suggested | Rahil Arora | CC BY-SA 3.0 |
Fixed grammar and improved formatting
|
| Dec 13, 2014 at 20:16 | review | Suggested edits | |||
| S Dec 13, 2014 at 21:52 | |||||
| Dec 13, 2014 at 16:12 | vote | accept | Serverfrog | ||
| Dec 13, 2014 at 15:50 | answer | added | Thomas Pornin | timeline score: 22 | |
| S Dec 13, 2014 at 14:06 | history | bounty started | Serverfrog | ||
| S Dec 13, 2014 at 14:06 | history | notice added | Serverfrog | Improve details | |
| Dec 11, 2014 at 10:48 | comment | added | dave_thompson_085 |
... but even if you carefully wipe all the Strings you have a reference to, there'll be lots more of them, and StringBuilders or StringBuffers and perhaps even other forms of the same data, in the middleware, and often un-reused pre-GC copies all lying about in memory, that you can't realistically find and wipe, which makes your effort largely ineffective. Sorry.
|
|
| Dec 11, 2014 at 10:43 | comment | added | dave_thompson_085 |
@user2313067 many Java APIs use (only) String, though a few mostly crypto-specific like Keystore.put do use char[] to be easy to wipe. @Serverfrog (1) you don't overwrite anything, arrays in Java are reference objects almost (not quite) like classes (2) if you do overwrite, randomness and especially cryptorandomness is a complete waste of time (and opportunity for failure) (3) if you do overwrite a String literal or otherwise interned value, like your example, you'll screw up lots of things, but of course a real password should never be literal and should not be interned. ...
|
|
| Dec 11, 2014 at 9:28 | comment | added | Serverfrog | many implementation i see used String as Input Value from the user, even Password Fields etc. See docs.oracle.com/javafx/2/api/javafx/scene/control/… and the getText Method, which is, as far as i know, the only possibility to get the password the user typed. | |
| Dec 11, 2014 at 6:06 | comment | added | user2313067 | Why use a String instead of a char[] in the first place? | |
| Dec 11, 2014 at 0:32 | review | Suggested edits | |||
| Dec 11, 2014 at 0:55 | |||||
| Dec 10, 2014 at 21:38 | history | tweeted | twitter.com/#!/StackSecurity/status/542795429076021248 | ||
| Dec 10, 2014 at 20:30 | history | asked | Serverfrog | CC BY-SA 3.0 |