Uploaded image for project: 'Derby'
  1. Derby
  2. DERBY-5538

Derby should use char[] to internally represent passwords, rather than String.

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Open
    • Major
    • Resolution: Unresolved
    • 10.8.2.2
    • None
    • JDBC
    • Normal
    • Security

    Description

      I noticed that routines like AuthenticationServiceBase.encryptUsingDefaultAlgorithm() represent plaintext passwords as Strings. This is unsafe because Strings are easy to sniff even after they go out of scope. See the discussion on DERBY-866. We should rephrase passwords as char[] and zero them out as soon as possible.

      Attachments

        Activity

          People

            dinuka.n Dinuka Kodithuwakku
            rhillegas Richard N. Hillegas
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated: