-1

I know that hardcoding passwords into a program is something insecure by nature. Most of them can be cracked by reverse engineering tools such as IDA Pro. However, if one had no choice other than to do so, would there be a secure way to do it?

I need to release a small Java client app to a small group of users and need to hardcode an authentication token. Any advice?

Thanks

user1060551
  • 421
  • 2
  • 11
  • 20
  • 1
    There isn't a way. As you noted, if the token is stored in the code it can be extracted by reverse engineering. – Stephen C Oct 03 '21 at 13:04

1 Answers1

0

If you must, Java has a GuardedString class, similar to the SecureString class in C#.

Secure string implementation that solves the problems associated with keeping passwords as java.lang.String. That is, anything represented as a String is kept in memory as a clear text password and stays in memory at least until it is garbage collected.

The GuardedString class alleviates this problem by storing the characters in memory in an encrypted form. The encryption key will be a randomly-generated key.

In their serialized form, GuardedString will be encrypted using a known default key. This is to provide a minimum level of protection regardless of the transport. For communications with the Remote Connector Framework it is recommended that deployments enable SSL for true encryption.

Applications may also wish to persist GuardedStrings. In the case of Identity Manager, it should convert GuardedStrings to EncryptedData so that they can be stored and managed using the Manage Encryption features of Identity Manager. Other applications may wish to serialize APIConfiguration as a whole. These applications are responsible for encrypting the APIConfiguration blob for an additional layer of security (beyond the basic default key encryption provided by GuardedString).

Ermiya Eskandary
  • 15,323
  • 3
  • 31
  • 44
  • Hi, this might work for memory, but how to safely store the token in the code itself? Someone could reverse engineer the code and search for password form texts in it. – user1060551 Oct 03 '21 at 13:01
  • 1
    Any password in an application that runs on the user's machine can eventually be reverse-engineered regardless of anything you do - you can only make it harder not impossible. There is never a "safe" way to store anything in an application to which the user has access. – Ermiya Eskandary Oct 03 '21 at 13:07