I have to store password to some other system in config file in my Java application (web app running on Tomcat). What are my options to protect it (both at rest and in memory)? (Hash is not an option)
at Rest: if I will encrypt the password in config file, where will I store a key? in other config file? doesn't sounds right...I don't want to hardcoded it in the code.
in Memory: I read that I shouldn't use String but char, but still if somebody will dump the memory he will have the password. Does Java have something like SecureString in .Net?