Recently I was having a look at the Merlin security provider documentation for Apache, and noticed that they store the keystore password (org.apache.ws.security.crypto.merlin.keystore.password) as a reversibly encoded string.
I was under the impression that it's never a good idea to store passwords in a string because we cannot reliably erase them from memory am I missing something about this particular implementation?
I'm not really sure what the context of the linked documentation is... but it seems like an interface for interacting with a keystore like the Java Keystore.
If the password is used to decrypt private keys, then you'll need to store it in some form until you're done using it. That means storing the password, or decrypting all the private keys you need, and discarding the password. Either way, you'll be keeping something secret in memory.
This is the constant tension we face in security. The only truly secure private key or password is one you cannot access. But if the key or password is to be useful, it needs to be held in memory at some point in time.
So the general answer to this would be no. This is what we would call “security through obscurity.” Meaning that you are hoping that hiding it will add a layer of protection. However, that is certainly not the case. All it takes is a little bit of effort from a malicious attacker to be able to get the original data back. You should NEVER trust that obscuring something makes it secure.
Additionally, since this is effectively storing the passwords in plain text (since we established obscurity is the equivalent of doing nothing at all) I would like to reinforce how terrible of an idea that is. Most people in the security industry would agree that storing secrets in plain text would be a fireable offense. There is much more concern with this than merely securely deleting the passwords such as theft by a malicious actor or untrusted/non-need to know people being able to read the data. Since there are many ways to exploit a server, any little slip up could result in those secrets being stolen even if the attacker can not get root.
I’m not sure why Merlin decided that reversible secrets is a good idea, but I would advise looking into Vault for secrets management. It is a great service provided by the makers of vagrant.
