Mailing-List: contact dev-help@commons.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Commons Developers List" <dev@commons.apache.org>
Received-SPF: pass (nike.apache.org: domain of sebbaz@gmail.com designates
 209.85.212.171 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <6152BDF053E74643B4C0A41150F5ADC301B5C840@USINVMAILB01.ingres.prv>
References: <6152BDF053E74643B4C0A41150F5ADC301B5C840@USINVMAILB01.ingres.prv>
Date: Mon, 8 Jul 2013 23:23:23 +0100
Message-ID: 
 <CAOGo0Vbht16rBEa0KBvFLM8vSHesK92zivDUufo=i8mH87OtnQ@mail.gmail.com>
Subject: Re: [VFS] Passing around password as byte[] instead
From: sebb <sebbaz@gmail.com>
To: Commons Developers List <dev@commons.apache.org>
Content-Type: text/plain; charset=ISO-8859-1

On 8 July 2013 23:05, Roger L. Whitcomb <Roger.Whitcomb@actian.com> wrote:
> I had a thought that it would be more secure to pass password data
> around in VFS as byte arrays instead of String objects so they could
> less easily be found by memory dumpers/scanners.  This would apply (for
> instance) to GenericFileName constructor and access methods, etc.
> Obviously, at some point, you have to convert to String (like in
> "GenericFileName.appendCredentials"), but it seems like at least some
> level of obfuscation, as in storing the data as bytes might be useful to
> increase security.

Another reason for using bytes is that the array can be zeroed out -
or replaced with fake password to fool hackers ;-) - once it has been
used.
This is not possible with immutable strings.

>
>
> Thoughts?  Thanks.
>
>
>
> ~Roger Whitcomb
>
> Apache Pivot PMC Chair
>

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org