CODEWITHSUNDEEP
javapasswordsjava-me
Jaron787
Jaron787

Reputation: 560

Hide Password Content in Source Code

Does anyone know how to hide the password contents in the source code of a j2me program? i.e. so people cannot see "DBT" as password who read the source code.

public void validateUser(String user, String Password) {     
  if (user.equals("N0203251") && Password.equals("DBT")) {
    switchDisplayable(null, getContinue());
  }
}

Upvotes: 3

Views: 7522

Answers (6)

Jeff Foster
Jeff Foster

Reputation: 44746

You could store the hash (MD5 / SHA1) of the password instead and compare this with the hash of the supplied passwords.

Make sure you calculate the hash externally to avoid having the original password mentioned anywhere in the executable.

Upvotes: 3

Eli Bendersky
Eli Bendersky

Reputation: 273806

Use a function that hashes the password - keep the hash of a password in the source, not the password itself.

A quote from that page:

A related application is password verification. Passwords are usually not stored in cleartext, for obvious reasons, but instead in digest form. To authenticate a user, the password presented by the user is hashed and compared with the stored hash. This is sometimes referred to as one-way encryption.

Upvotes: 1

atk
atk

Reputation: 9324

When it comes down to it, you've written a back door into the program. That's a Bad Thing - don't do it.

Like others have said, you can do better by using a hash, but a couple critical things are left out. When someone guesses the password, they'll know the password for every installed copy of your software. Since the password is hard coded, nobody will be able to change it or revoke it, so you'll have inserted a back door in the program that nobody can eliminate. And if you rely on that password ofr any communication with other resources, you can't ever change it - at least, not without significant additional work.

What you should really do is place the password in an external location, such as a hardware security module, or password file, or database table. Then, implement a full password change and rotation mechanism - honestly, this should be pretty much the same mechanism you use across all your passwords.

Upvotes: 3

President James K. Polk
President James K. Polk

Reputation: 42018

Storing the hash instead the password buys you absolutely nothing. Since it is now the hash being used to authenticate instead of the password, reading the source code (or reversing the object code) will reveal the hash and allow the attacker to authenticate.

The answer to these questions is always the same. You can't achieve any measurable security if you use hard-coded client-side secrets no matter what you do. The best you can do is obfuscate enough until you get a warm fuzzy feeling that it is good enough.

Upvotes: -1

dmckee --- ex-moderator kitten
dmckee --- ex-moderator kitten

Reputation: 101299

As other have said. Store the hash, though you still need to use a strong password or an automated guesser will find the one you're using.

But, be warned:

If your attacker has access to the source code he/she/it can alter the stored password hash or just remove the password check.

So this method is of little use unless you can verify the integrity of the code being run, which is hard.

Upvotes: 6

avpx
avpx

Reputation: 1922

If you are storing the application on the user's mobile device, the best you can do is try to obscure the password. I would recommend doing some sort of hashing algorithm (maybe SHA1) or a key derivation algorithm like PBKDF2 and storing the result rather than comparing against the plaintext password.

Upvotes: 0

Related Questions