Subject: CoverGirl's Fine-Line Repair

From: How Ellen Tweaked her Face <[email-masked]>
Date: Tue, 10 Jun 2014 11:45:28 -0700

Ellen Degeneres has been in the spotlight bc of Divorce Rumors
- Have you seen the latest Paparazzi pics of her?

Hollywood is whispering that she got a facelift to save her Marriage.
She Didn't... She did it Naturally.

View how how she did it here -> http://www.lionworn.com/ellen/degeneres/paparazzo/pics.html

In ONE month she turned back the clock by 20 yrs.
- and hopefully will save her marriage bc of it-

- June 10th Update -

to stop further celeb updates write Member Update Systems
at nine one six seven R O A D 1 7 7_Oakwood, OH 45873 or visit http://www.lionworn.com/4tw/8354g/4olf.5rgwe

Strings would very rarely be stored on the stack, and this advice predates the escape analysis required to store them on the stack by a long time. It's not clear where hashCode() and equals() come in at all - hashCode() shouldn't be used for security purposes in the first place, and if you've got access to the memory, there'd be no point in hashing at all - you'd just read the data directly. So basically, I don't think that's part of it at all.   Jon Skeet Jan 15 '13 at 6:43
  	  	
Obviously if Java had clearable memory, then the password could be kept in memory only as long as needed (to verify against the stored one). This answer says that using char[] will make the memory actually get cleared properly, but then the edit says it wont. So then what is the actual point in using char[] over String for a password? No point? i.e, it's unclear what this answer is actually saying.   Dog May 20 '13 at 13:34
2	  	
@Dog: It says that the vulnerability is at least reduced by using char[]. Depending on the behaviour of the GC, it could be very greatly reduced, but that's implementation-specific. Where does the spec say this is implementation specific? I would intuitively think that what happens is simply undefined, especially with JIT/GC. How do you know the vulnerability is even reduced at all? Also I can't see how you can actually use the char[] without leaking more data from it.  You can use the char, but then clear it. The behaviour being undefined is implementation-specific in this context. (In some contexts the two are significantly different, but in this case I don't believe they are.)     	
haha I was sure the answer was related to the "strings are immutable" thing- It's amazing the amount of different implications this has. Specially interesting is the fact that they will not be destroyed until the GC kicks in...   rupps Jun 26 '13 at 2:18
  	  	
So what I'm getting from all of this is "don't use char[] because it's not necessarily more secure, so don't pretend like it is. Use SecureString if you actually care about security on this level, otherwise just use string so security questions are raised in the future, when necessary."   Christopher Harris Dec 6 '13 at 19:54 
1	  	
@ChristopherHarris: Well SecureString is better than char[], but char[] is better than String - where "better than" is an indication of the attack vectors available. Security is often about working out how much effort you want to put into stopping which attack vectors.   Jon Skeet Dec 6 '13 at 19:56 
  	  	
Isn't that just "security through obscurity" though? It just sounds like using char[] to prevent outputting a password is avoiding the issue of security all together. How long is the password unencrypted that there is a more serious risk of outputting it? Furthermore, shouldn't a variable name of "password" tell a developer that they shouldn't print it? Lastly, we have ways of preventing objects from being serialized, so why wouldn't we prevent the serialization of objects containing unencrypted passwords? The whole thing seems a little "better than nothing", which can lead to confusion.   Christopher Harris Dec 6 '13 at 20:04 
  	  	
The previous comment is assuming that not all char[] passwords will get cleared out, and if that's the case, the security of using char[] is for not. If you use SecureString, you're forced to examine each case that could be a security threat. The Type's name itself indicates to the developer that they are working with sensitive information.   Christopher Harris Dec 6 '13 at 20:07 
1	  	
@ChristopherHarris: No, it's not just security through obscurity. It's determinining which vectors are actually a risk, and making a pragmatic judgement as to how much effort to put into it. And your assumption that the developer isn't going to clear the char[] changes things completely - why would you assume such a thing? Your comments seem confused about where the attack is going to come from - we're not talking about developers doing daft things like serializing passwords; we're talking about hackers with access to the machine's memory.   Jon Skeet Dec 6 '13 at 20:11
  	  	
Some of that comment was inspired by another answer. Sorry for confusing them. I'm assuming that a developer will forget to clear a char[], simply because whatever can go wrong will go wrong. Unless we create unit tests to make sure passwords don't show up in memory dumps, there's no way of knowing if all char[]s are being cleared. Personally, I'd like to see more people using SecureString so that it becomes common practice. Normal. Easy. I just don't see why anyone would use char[] when SecurePassword is available, except to reduce the effort it takes to code. It seems lazy.