Recently I was having a look at the Merlin security provider documentation for Apache, and noticed that they store the keystore password (org.apache.ws.security.crypto.merlin.keystore.password) as a reversibly encoded string.

I was under the impression that it's never a good idea to store passwords in a string because we cannot reliably erase them from memory am I missing something about this particular implementation?

  • 1
    An character-encoded, encrypted and then encoded password is also a reversably encoded string. Without a security design and / or review of the security practices it is hard to say if this is the best possible protection of the password. The API documentation certainly isn't any help. I'm not saying that it is good - I programmed my own specialized WS-security implementation because I couldn't validate the existing ones - but I cannot say that this implementation is lacking security either. – Maarten Bodewes Apr 24 '18 at 16:05

I'm not really sure what the context of the linked documentation is... but it seems like an interface for interacting with a keystore like the Java Keystore.

If the password is used to decrypt private keys, then you'll need to store it in some form until you're done using it. That means storing the password, or decrypting all the private keys you need, and discarding the password. Either way, you'll be keeping something secret in memory.

This is the constant tension we face in security. The only truly secure private key or password is one you cannot access. But if the key or password is to be useful, it needs to be held in memory at some point in time.


So the general answer to this would be no. This is what we would call “security through obscurity.” Meaning that you are hoping that hiding it will add a layer of protection. However, that is certainly not the case. All it takes is a little bit of effort from a malicious attacker to be able to get the original data back. You should NEVER trust that obscuring something makes it secure.

Additionally, since this is effectively storing the passwords in plain text (since we established obscurity is the equivalent of doing nothing at all) I would like to reinforce how terrible of an idea that is. Most people in the security industry would agree that storing secrets in plain text would be a fireable offense. There is much more concern with this than merely securely deleting the passwords such as theft by a malicious actor or untrusted/non-need to know people being able to read the data. Since there are many ways to exploit a server, any little slip up could result in those secrets being stolen even if the attacker can not get root.

I’m not sure why Merlin decided that reversible secrets is a good idea, but I would advise looking into Vault for secrets management. It is a great service provided by the makers of vagrant.

  • isn't vault also reversible? – Jasen Apr 21 '18 at 6:44
  • @Jasen “All data that Vault stores is encrypted.” - Hashicorp. I haven’t dug around too deep, but this appears to be the case. – SuperAdmin Apr 21 '18 at 11:22
  • Add some point you have to store something like this in the same or similar fashion and rely on the OS security. Sure they could encrypt that password, but then they'd need the key to decrypt it and it can be obscured or encrypted, but if encrypted then THAT key needs to be protected. You can't protect the initial item without having a password or key that's not encrypted in some form. – Swashbuckler Apr 23 '18 at 3:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.