I have a form which contains a password field.

In swing the getPassword() method returns a character array. After the password has been processed by my web application the array can be wiped to remove the password from memory. This is not possible when using Strings because Strings are immutable. Using arrays reduces the risk of memory disclosure attacks.

How can I achieve this, i.e. not using Strings for passwords in Wicket?

This page has an example with Strings.


Actually you cannot really "remove the password from memory". Not nowadays.

In older times, memory allocation strategies in Java virtual machines were relatively simple; when a block was allocated, it was allocated once, and remained in memory, until the GC decided that it was no longer reachable and thus could be released. In that mode, allocation is similar to what C programmers call malloc(). For these JVM, the GC was conservative: it did not always reliably detect whether a given piece of data in memory was a pointer or something else (e.g. an integer or some characters), and thus assumed that everything which looked like a pointer had to be treated as such, for garbage collection purposes.

Since Java is a strictly typed language, it allowed the implementations of stricter GC who have strong knowledge of what is a pointer and what is not. This allows these GC to move objects in memory. From your side, in the Java source code, this is completely transparent. But internally, the GC may decide to move an object from one emplacement in RAM to another, automatically fixing all pointers to now point at the new copy of the object. Doing so enables a lot of optimizations which make that kind of GC quite desirable (better cache coherency, very fast allocation...). All JVM from the last decade use such better GC algorithms.

However, a consequence of these newer, enhanced GC is that old copies of objects may linger in RAM. When you "wipe" a char[], you are only writing to the latest in-memory copy of the array; remnants of older copies may still be there and contain your password, completely out of your reach since all of this is done transparently, invisible from the developer.

Therefore, the tradition of storing passwords in char[] and wiping them is just that: a Tradition. It used to be justified, in days from the previous century, when the JVM was using a conservative GC. At that time, wiping worked and was really removing secret data from memory. These days have finished. Programmer-driven wiping no longer works. So it makes no sense to make a difference between char[] and String; just use the String and be done with it.

If you believe in the importance of wiping, then the correct way to do it is to integrate the automatic wiping within the GC, systematically applied to all objects. I don't know if the current JVM from Oracle (or OpenJDK) offers an option for that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.