3 ms·
> If you are worried, you can store the password in a byte array and zero that out. if it's a copying collector this is no guarantee of anything but the same
by blibble 4y ago
> If you are worried, you can store the password in a byte array and zero that out.
if it's a copying collector this is no guarantee of anything
but the same is true of general memory allocated with the OS (swap/THP/...), unless you use something like mlock()
- cogman10 4y agoFair point, but really one of those situations where if an attacker is in the position to look at a password stored in a tombstone, you've got bigger problems (for example, would be trivial in that scenario to simply intercept the password rather than looking for it in VM memory).
- paulryanrogers 4y agoCould it still add some defense in depth for other scenarios?