Question

We have a getter method within a class.
Within the same JAR we want the variable to be accessible with the no-identifier access level, from the same package and subpackages.

Below the access levels from: http://docs.oracle.com/javase/tutorial/java/javaOO/accesscontrol.html

Our problem is, how do we stop someone from taking the compiled .JAR, creating a class with the same package namespace definition, and being able to access our variable through the getter?

We thought about getting rid of all getters for the specific variable, and giving the variable value to other classes with setters and constructors, when they pass a reference to themselves. Obviously, they will be final classes. This way all objects needing the variable value have their own private copy.

I’m wondering though if there is a better way?

Answer 1

Access control modifiers (public, private, protected) are not meant as a security tool, but as an OO design tool. They’re used to implement OO patterns like encapsulation, inheritance.

Even with no getter whatsoever and a private variable, any Java developer can use reflection to access the variable.

If you want to keep something secret, don’t ever put it in a variable of a program executed by anyone. Keep it on your own machines.