VietMX Staff asked 3 years ago
Problem
Why does String pose a threat to security when it comes to passwords? It feels inconvenient to use char[]?
Strings are immutable. That means once you’ve created the String, if another process can dump memory, there’s no way (aside from reflection) you can get rid of the data before garbage collection kicks in.
With an array, you can explicitly wipe the data after you’re done with it. You can overwrite the array with anything you like, and the password won’t be present anywhere in the system, even before garbage collection.
