Why we read password from console in char array instead of String

Question

Possible Duplicate:
Why is char[] preferred over string for passwords?

When I was preparing for OCPJP I came accross the topic - "Reading User input from console".

There was an example where it read username in String reference, whereas password in a char[] array, but I couldn't understand why it used char array.. Here is the code : -

Console console = System.console();

String username = console.readLine("User Name? ");
char[] password = console.readPassword("Password? ");

This raised a doubt in my mind.. Why didn't we used String reference to store password. Since Strings are immutable, so it must be more secure to read password in a String, as its content could not be changed for that matter.

So, what's the whole point in reading password in char[] array..

Can anyone shed some light in this matter?

score 11 · Accepted Answer · answered Oct 02 '12 at 13:11

11

As you said, strings are immutable, meaning that once you've created the string, if another process can dump memory, there's no way (ok, may with reflection) you can get rid of the data before GC kicks in.

With an array, you can explicitly wipe the data after you're done with it: you can overwrite the array with anything you like, and the password won't be present anywhere in the system, even before garbage collection.

answered Oct 02 '12 at 13:11

caarlos0

20,020
27
85
160

1

At least that is the intent of using char arrays for passwords. I am however not so sure if it considering heap defragmenting, virtual memory, swapping etc. is really true. If e.g. defragmenting the heap causes the char array to be moved within the process' memory space, will the content on the old location actually be erased? – jarnbjo Oct 02 '12 at 13:38
I believe that it depends of the the GC specific implementation... – caarlos0 Oct 02 '12 at 13:53

score 7 · Answer 2 · edited Mar 08 '16 at 19:53

7

From the Javadoc of java.io.Console:

Security note: If an application needs to read a password or other secure data, it should use readPassword() or readPassword(String, Object...) and manually zero the returned character array after processing to minimize the lifetime of sensitive data in memory.

This is just to prevent other applications (like keyloggers etc., from accessing the password.

And moreover if you use String, since they are immutable, modifying them would create copies in the memory. Using char[] would save you in this case. As they are mutable, they won't create an copies and you can make them null after processing.

edited Mar 08 '16 at 19:53

Nayuki

17,911
6
53
80

answered Oct 02 '12 at 13:12

Sri Harsha Chilakapati

11,744
6
50
91

don't see how char[] can differ from String for a keylogger... – caarlos0 Oct 02 '12 at 13:22
@caarlos0 Actually this does not prevent the keylogger but gives it less opportunity to read the contents because the copies are unavailable and the data will be nullified. – Sri Harsha Chilakapati Oct 02 '12 at 13:26
correct me if I'm wrong, but, I think that keylogger capture keyboard events.. so, doesn't matter what data type you're using... right? I believe that it only prevents people to get the Strings from a memory dump. – caarlos0 Oct 02 '12 at 13:30
They can't get the keys from the input directly because of focusing issue. Instead they had to read the memory. – Sri Harsha Chilakapati Oct 02 '12 at 13:34
hm, in this case, you're right. thanks. – caarlos0 Oct 02 '12 at 13:47

score 5 · Answer 3 · answered Oct 02 '12 at 13:11

I believe that it is so you can clear them from memory by overwriting them when you no longer need them. With Java at least, if you use String, then there may be copies leftover in memory.

If you overwrite the char array using a for loop and set each value to 0, I don't think there will be any leftover copies in memory.

score 4 · Answer 4 · answered Oct 02 '12 at 13:11

4

As strings are immutable, they cannot be overwritten and remain in memory while the application is active. A char array, on the other hand can be cleared of all password information.

answered Oct 02 '12 at 13:11

Reimeus

158,255
15
216
276

Why we read password from console in char array instead of String

4 Answers4

Linked