10

Imagine there is a login form in Java application. We need assign usename and password to variables. Moment after we can Hash or HMAC password and keep it just for authentication step (no caching). But still we need to assign variable for Raw password.

Q1) What sort of variable type we should use to store Raw password(String, Char array or else)?

Q2) What should we do variable of Raw password after using (i.e. Just allow garbage collector to dump it after function go out of scope)?

Q3) Anything else?

This is a Java related question. I posted it here since it very much close to security.

For the C/C++ I have little idea. They are

  • Store password in low system level variable which not depends on other libraries. I.e. store password in char [] which is very native than QString (Qt) type variables provided by frameworks.

  • Immediately overwrite password char[] after use it. Then destroy it.

  • Reduce the time of password in memory as low.

10

The general guidance is to use a char[], which while not foolproof, will allow you to overwrite the characters in the password once you're done with them, something that is not possible with strings, as they are immutable and continue to live on the heap until garbage collection.

This has also been discussed in detail on StackOverflow.

  • It seems to be better option is go for char[] and overwrite it before GC does. (stackoverflow.com/questions/8881291/…) – Kasun Nov 25 '14 at 20:06
  • 2
    The only problem with this method is that I have yet to meet a java web application container that doesn't default to sending parameters over as Strings in the first place. This means your cleartext password will sit in memory until the string pool is finally collected. If your JVM is < 1.7 it'll be in permgen space. – avgvstvs Feb 5 '16 at 15:11
  • Are there no "SecureMemory" wrappers in any of the big libraries (std lib, guava, apache commons, etc.)? You could make a wrapper for a char/byte array that makes it transient, and implement closable to zero out the memory. – Alexander Jul 11 '17 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.