9

I have an Akka project that needs several passwords to work: to access a datastore, a distributed filesystem connection string...

Those values are not hardcoded in the configuration file, but rather pulled from a key vault at run time during app startup and then stored in memory in a typesafe config object as the thirdparty are using this configuration to get the password and open the connections.

I am just wondering if somehow this is risky, as I am guessing the strings would be in clear in memory. Is there a way to transparently obfuscate/encrypt the values ? Or do I need to implement it on my side, and update the thirdparties so that they transform the string before actually opening the connections.

CanardMoussant
  • 913
  • 8
  • 22

2 Answers2

6

In my opinion that is, in almost every application, a security risk you should not be concerned of. Since Scala runs on the JVM please refer to: Sensitive Data In Memory.

Federico Pellegatta
  • 3,977
  • 1
  • 17
  • 29
  • Well, unfortunately my colleagues do not share this point of view :). I read in several places that in Java it is safer to use array of bytes instead of Strings but here I rely on Typesafe config objects to hold the data :-(. – CanardMoussant Mar 31 '17 at 13:41
  • Can you give some links to those "several places"? – Chrs Mar 31 '17 at 15:07
  • http://stackoverflow.com/questions/8881291/why-is-char-preferred-over-string-for-passwords – Federico Pellegatta Mar 31 '17 at 15:37
0

You can try to use sun.misc.Unsafe to clear memory right after password was used:

    String password = new String("l00k@myHor$e");
String fake = new String(password.replaceAll(".", "?"));
System.out.println(password); // l00k@myHor$e
System.out.println(fake); // ????????????

getUnsafe().copyMemory(
          fake, 0L, null, toAddress(password), sizeOf(password));

System.out.println(password); // ????????????
System.out.println(fake); // ????????????

or via reflection:

Field stringValue = String.class.getDeclaredField("value");
stringValue.setAccessible(true);
char[] mem = (char[]) stringValue.get(password);
for (int i=0; i < mem.length; i++) {
  mem[i] = '?';
}

http://mishadoff.com/blog/java-magic-part-4-sun-dot-misc-dot-unsafe/

Alex Chernyshev
  • 1,719
  • 9
  • 11