Question

I have following code

public static void main(String[] args) {

    String plainTextpassword = "plaintextpassword";
    String encryptedPassword = getMd5Password(plainTextpassword);
}

Is there any possibility that someone can take my password before garbage collected, using memory dump or any way. If it is so how I can overcome it.

Answer 1

Is there any possibility that someone can take my password before garbage collected , using memory dump or any way

Yes, and it’s possible even after garbage collection, as the contents of the memory are not immediately overwritten. That’s the bad news.

The good news is, that the OS should separate the address spaces between processes. I wrote should, because occassionally some bug is found that can be exploited to overcome this separation; however if such a bug is found, password protection is the least of your problem. So I’d not worry about that.

So the most severe thing to happen is, that something in your own program’s process goes awol. This can be due to bugs in your code or because you use some library with some bugs. However if your program is bug-free (very unlikely though), and your OS is bug-free (also unlikely but still more likely than your own program being bug-free) then your password should be safe.