Why is storing a cipher character array more appropriate than a string?

Personally, it makes sense: any string-related problems must be found in the clues in the properties of the string.

Why is storing a cipher character array more appropriate than a string?

1. Because the string is an immutable object, if the password is stored as plain text, it will persist in memory until it is reclaimed by the garbage collector. Because the string is taken out of the string pool (if the string in the pool is taken directly from the pool, the new one comes out and then puts it into the pool), so there is a great chance of keeping it in memory for a long time, which raises security issues. Because anyone who can access the memory can dump the password in a plaintext way. In addition, you should always use encryption instead of plain text to represent the password. Since the string is immutable, there is no way to change its contents, and any change will result in a new string, and if you use char[], you can set all the elements to be empty or 0 (here the author means to say, let the array is no longer used after authentication, You can overwrite the original password with 0 or null to prevent others from going out of memory. So storing passwords with character arrays can significantly reduce the risk of password theft.

2, the Java official itself also recommended character array, JPasswordField method GetPassword () is to return a character array, and for security reasons GetText () method is discarded, because it returns a plain text string. Follow the steps of the Java team, no mistake.

3. It can also be dangerous to print a string in plain text in the log file or console, but if you use an array you cannot print the contents of the array, but rather its memory address. Although this is not the real reason for it, it is still worth noting.

Of course, the character array will not necessarily be more secure, or you have to use password encryption instead of ordinary text is better, and once the certification, as soon as possible to clear out;

Why is storing a cipher character array more appropriate than a string?