14

Imagine there is a login form in Java application. We need assign usename and password to variables. Moment after we can Hash or HMAC password and keep it just for authentication step (no caching). But still we need to assign variable for Raw password.

Q1) What sort of variable type we should use to store Raw password(String, Char array or else)?

Q2) What should we do variable of Raw password after using (i.e. Just allow garbage collector to dump it after function go out of scope)?

Q3) Anything else?

This is a Java related question. I posted it here since it very much close to security.

For the C/C++ I have little idea. They are

  • Store password in low system level variable which not depends on other libraries. I.e. store password in char [] which is very native than QString (Qt) type variables provided by frameworks.

  • Immediately overwrite password char[] after use it. Then destroy it.

  • Reduce the time of password in memory as low.

Improve this question

2 Answers 2

Reset to default
17

The general guidance is to use a char[], which while not foolproof, will allow you to overwrite the characters in the password once you're done with them, something that is not possible with strings, as they are immutable and continue to live on the heap until garbage collection.

This has also been discussed in detail on StackOverflow.

Improve this answer
3
  • 1
    It seems to be better option is go for char[] and overwrite it before GC does. (stackoverflow.com/questions/8881291/…)
    – Kasun
    Commented Nov 25, 2014 at 20:06
  • 3
    The only problem with this method is that I have yet to meet a java web application container that doesn't default to sending parameters over as Strings in the first place. This means your cleartext password will sit in memory until the string pool is finally collected. If your JVM is < 1.7 it'll be in permgen space.
    – avgvstvs
    Commented Feb 5, 2016 at 15:11
  • Are there no "SecureMemory" wrappers in any of the big libraries (std lib, guava, apache commons, etc.)? You could make a wrapper for a char/byte array that makes it transient, and implement closable to zero out the memory.
    – Alexander
    Commented Jul 11, 2017 at 14:50
2

There is indeed a secureMemory style wrapper provided by high level languages like Java, C#. An example in Java would be GuardedString.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .