0

I am currently writing an App using CodenameOne, and there is a login screen, where the user needs to insert their account and password.

Now I was wondering, what would be the best way to access the password field.

First of all, I need the password to be send to the server to get an auth-token. Sending the login credentials on start of the app is currently unencrypted, but I am not sure if this is a good idea in case of security, one could simply sniff the connection and get them plaintext. Changing this on the backend of the app is no problem, so I could also send an encrypted password to get the auth-token.

But this is not my question.

My specific question in this case is:

Let's assume I have a passwordField called passwordTextField and can access it using getText().

Is it okay to encrypt it like this

String passwd = passwordTextField.getText();
String encPasswd = sha512.encrypt(passwd);

which is easier to read or would it be better to 

String encPasswd = sha512.encrypt(passwordTextField.getText());

when it comes to security? Is there a difference at all?

Do Re
  • 103
  • 3
  • 1
    From this point it doesn't matter. If someone is able to look into the local (stack) variable, the second line does effectively the same. It is common practice to store the password into the char[] array and then wipe the array. Once you have it as a string, it stays somewhere in memory for longer time. However - if you read it from the UI field, you have no other choice anyway. – gusto2 Jul 15 '16 at 07:43
  • **Hashing passwords the way you do in your code samples is incredibly insecure.** Read up on [how to securely hash passwords](http://security.stackexchange.com/questions/211/how-to-securely-hash-passwords) and [LinkedIn's password database compromise](http://arstechnica.com/security/2016/06/how-linkedins-password-sloppiness-hurts-us-all/), which was catastrophically exacerbated by them hashing passwords similarly to how you are doing (see also [this analysis](https://blog.korelogic.com/blog/2016/05/19/linkedin_passwords_2016)). – Luis Casillas Jul 15 '16 at 16:18

1 Answers1

3

The two code snippets will very likely compile to the exact same bytecode, so no difference. Even if it wasn't the case, passwd contains only a reference to the string containing the password, no extra copy of the value is created.

Najkin
  • 383
  • 2
  • 10