| scorpion 2004-04-06, 9:55 am |
| Hi,
I have a small problem like this:
When the user starts up an application, it pops up a dialog to
prompt for login. After successful login, it opens some locally
encrypted files for the user. And later on, when the user wants,
he can logon to a server. At this time, we don't want to prompt
for password again, as the password to the server and the
password for the local encrypted files are the same, and they
are kept in sync.
Now, we need to keep the password in memory for the user,
if he ever wants to connect to the server.
Is there a secure way to manage the passwords (and other sensitive
data) in memory like that? What do you normally do in this kind
of situations?
In Linux, in C, you can use a combination of mlock() for locking the
memory, and ulimit() to prevent mem swapping and dumping.
In Java, besides using transient variable, what else can you do?
As a related question, how do you prevent a cracker to drop a rogue
java class into your environment, to be loaded up during startup,
and retrieve your password or other sensitve data?
Any help will be appreciated.
TIA.
|