Re: secure storage of sensitive data in J2EE

Cant we simply force garbage collection when you are done using the object?
Here is a link.
http://java.sun.com/docs/books/tutorial/essential/system/garbage.html

Kevin Conaway wrote:

> A followup question:
> 
> Once the data (be it a password or a key) has been read into memory,
> what is an effective and secure way of minimizing the window that the
> plaintext key or password is in memory?
> 
> If the data is read into a char [] and then overwritten with junk
> data, would that work?
> 
> Kevin
> 
> On Tue, 25 Jan 2005 09:18:15 +0000, chaim moshe <[email protected]> wrote:
> 
>>Hello list,
>>
>>where can I  store sensitive data like encryption keys, passwords, etc. in
>>J2EE?
>>surely, you can save it in the keystore, but the catch is where do you store
>>the keystore password to protect it from external access?
>>storing the keystore password in code or in config files is not secured
>>enough.
>>
>>In the .NET environment you have DPAPI that was designed exactly for this
>>kind of problem, the sensitive data is encrypted at the OS level with the
>>user/machine password and is decrypted at runtime.
>>What is the solution in the J2EE environment ?
>>
>>Thanks!
>>
>>_________________________________________________________________
>>Express yourself instantly with MSN Messenger! Download today it's FREE!
>>http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
>>
>>
> 
>