[jira] [Commented] (WICKET-4713) Do not pass passwords as String

["Martin Grigorov (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/WICKET-4713?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13436574#comment-13436574 ] 

Martin Grigorov commented on WICKET-4713:
-----------------------------------------

How WebSession is affected ?
And how would you enter your password as byte array in the HTML input field ?

We need to transfer it from the browser to the server as String and then convert it to byte[] for PasswordTextField but this wont solve your concern because the String will be still in the memory and dumping it will show it.
                
> Do not pass passwords as String
> -------------------------------
>
>                 Key: WICKET-4713
>                 URL: https://issues.apache.org/jira/browse/WICKET-4713
>             Project: Wicket
>          Issue Type: Improvement
>          Components: wicket
>    Affects Versions: 1.5.7, 6.0.0-beta3
>         Environment: N/A
>            Reporter: W.Mazur
>              Labels: security
>   Original Estimate: 168h
>  Remaining Estimate: 168h
>
> Security conscious user may not like passing passwords as String. I would prefer to pass password as byte[] (so I can overwrite it with zeros when I don't need it - you cannot do it with String since it's immutable). 
> Detailed issue description may be found here: http://stackoverflow.com/questions/8881291/why-is-char-preferred-over-string-for-passwords.
> Affected classes: WebSession.java, PasswordTextField...

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira