Java - How to store password used in application?

java passwords store
Mauri picture Mauri · Nov 19, 2011 · Viewed 51.1k times · Source

I'm developing an application which read some data from a db. The connection to the db is performed through standard login/password mechanism.

The problem is: how to store the db password? If I store it as a class member, it can be easily retrieved through a decompiling operation.

I think that obfuscation doesn't solve the problem, since a string password can be found easily also in obfuscated code .

Anyone has suggestions?

Answer

COD3BOY picture COD3BOY · Nov 19, 2011

Never hard-code passwords into your code. This was brought up recently in the Top 25 Most Dangerous Programming Mistakes

Hard-coding a secret account and password into your software is extremely convenient -- for skilled reverse engineers. If the password is the same across all your software, then every customer becomes vulnerable when that password inevitably becomes known. And because it's hard-coded, it's a huge pain to fix.

You should store configuration information, including passwords, in a separate file that the application reads when it starts. That is the only real way to prevent the password from leaking as a result of decompilation (never compile it into the binary to begin with).

See this wonderful answer for more detailed explanation : By William Brendel

Related questions

Java 256-bit AES Password-Based Encryption

I need to implement 256 bit AES encryption, but all the examples I have found online use a "KeyGenerator" to generate a 256 bit key, but I would like to use my own passkey. How can I create my own key? I …

Read More
Why is char[] preferred over String for passwords?

In Swing, the password field has a getPassword() (returns char[]) method instead of the usual getText() (returns String) method. Similarly, I have come across a suggestion not to use String to handle passwords. Why does String pose a threat to …

Read More
How can I hash a password in Java?

I need to hash passwords for storage in a database. How can I do this in Java? I was hoping to take the plain text password, add a random salt, then store the salt and the hashed password in the …

Read More