Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security SecProg
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: secure storage of sensitive data in J2EE

from [Valdis . Kletnieks] Network Security [Permanent Link]
Subject: Re: secure storage of sensitive data in J2EE
Date: Mon, 07 Feb 2005 21:13:50 -0500 
On Tue, 08 Feb 2005 00:36:41 GMT, Antoine Martin said:

On Mon, 2005-02-07 at 14:41 -0500, Kevin Conaway wrote:

A followup question:

Once the data (be it a password or a key) has been read into memory,
what is an effective and secure way of minimizing the window that the
plaintext key or password is in memory?

If the data is read into a char [] and then overwritten with junk
data, would that work?

Not if your buffer gets swapped out beforehand, but the window of
opportunity remains short.


If you are on a system where you can use mlock(), that can help minimize
the swapped-out-buffer issue.  Not sure if you can get at mlock() from the J2EE
environment, though....

Attachment: pgp8f1T77xkDV.pgp
Description: PGP signature

[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: secure storage of sensitive data in J2EE, Dimitris Mistriotis
Next by Date:  Re: php - inject code into $_SERVER ?, Ole Martin Eide
Previous by Thread:  Re: secure storage of sensitive data in J2EE, Antoine Martin
Next by Thread:  Re: secure storage of sensitive data in J2EE, Dimitris Mistriotis
Indexes:  [Date] [Thread] [Top] [All Lists]