Why password should be stored in char array char[] instead of string?

In this video, I have explained - Why password should be stored in char array char[] instead of string in Java?
~~~Subscribe to this channel, and press bell icon to get some interesting videos on Selenium and Automation:
www.youtube.co...
Follow me on my Facebook Page:
/ naveenqtpexpert
Let's join our Automation community for some amazing knowledge sharing and group discussion on Telegram:
t.me/joinchat/...
Naveen AutomationLabs Paid Courses:
Java & Selenium:
naveenautomatio...
Java & API +POSTMAN + RestAssured + HttpClient:
naveenautomatio...

[@ahamedabdulrahman]

Hi Naveen. Good content. If String's immutability is the problem, why not use StringBuffer or StringBuilder?

[@pargatsingh5261]

Same question i have?

[@devangsharma8937]

Same question?

[@jacknjill8096]

No you can't, Stringbuilder internally uses char[], the problem is when you overflow the char[] used by the StringBuilder, it is replaced by a larger array, but the original array (with part of your password in it) remains in memory until it is garbage-collected.So one cam dump the heap and steal the data

[@ahamedabdulrahman]

@@jacknjill8096 if we use char[] and modify password to a bigger length, the same happens, right? We cannot increase the char[] length. So we have to make a new char[]. That's pretty much the same, right?

[@jacknjill8096]

@@ahamedabdulrahman not exactly same, bcz you can control your own char[], but not the one used by StringBuilder

[@subramanianr2744]

Please don't skip ads in Naveen's video that is how we can pay him back. KZbin pays when ads are not skipped.

[@naveenautomationlabs]

Thanks for your support 🐱

[@swatibabaladi5825]

Appreciate how you explain things in an easy way 🙌

[@rahuldiliprautiddpharmaceu5246]

Hi Naveen, this video was really very conceptual please bring up such videos keeps us updated

[@rounak1912]

Good to finally see someone making good useful content for java aside from the stereotypical java related content.

[@vishalavishala1883]

Thanks so much Naveen, you are showing ways to grow higher technically. Please restart Selenium coding challenge.

[@jvsnyc]

I have some doubt about saying "all strings are in the SCP" (String Constant Pool). All strings live on the heap, for sure, but the only ones in the "String Constant Pool" are those found as "StringCompileConstants" in the source code, or ones that have had .intern() called on them. I think the whole rest of the discussion is still valid, however, not all of the Strings living in our program, i.e. those typed in, read from a file, database or web query, are actually in the String Constant Pool per se. It doesn't affect the reasoning given here, but confusion about which strings are kept in the String Constant Pool can be something else asked on an interview, so I mention it.

[@vengateshm2122]

Awesome. Thank you for contributing to the community.

[@mayankchandel373]

Informative video , Good content . Pls Keep sharing this type of video . Your voice is having more base, might be after your post covid recovery .

[@ajeetgour907]

I m going to apply this in my framework, thanks Naveen

[@sreereshvkm726]

Great..❤️ Thanks for sharing valuable knowledge

[@KkdvPrasad]

@Naveen Why not you do a video on how we work the payment details while passing through automation script? Many of us don't know how to pass credit card details in script using any encryption techniques or from database how we fetch live credit card details in script, can you do a video for us?

[@naveenautomationlabs]

My question is testing env, why do you need live CC details? And System does not store CC details like its bank account password and CVV number. User has to enter it at run time and though payment APIs, it will be validated with bank server.

[@KkdvPrasad]

@@naveenautomationlabs In my office we are testing using live credit card details in live site, I guess that is not recommend so want to know how to do that with secure

[@hardikrana6668]

@@KkdvPrasad so you are saying no api is integrated?? that can't be possible right! If that is the scenario how you are matching the card details.

[@KkdvPrasad]

@@hardikrana6668 Not understand

[@hardikrana6668]

@@KkdvPrasad are you not using test environment for this where you can use dummy cc details?? Secondly, are you saying your company is saving cc details? I guess what you are doing in company is.. on prod env through apis you are verifying cc details.. apis nowadays comes with great security.

[@rohitsoni2598]

Always learn something new.

[@pandudamera7211]

Good Example brother

[@aswinimohanty1507]

We have two string. We have to concat those two strings. Condition: If the element of first-string getter than 4 & second string is greater than 2 then it takes only first 4 char from string 1 & 2 from String 2 otherwise as usual.

[@KumarSushobhan]

Hello sir, Question- why do we need to store password ? We can encrypt and store it. Nowadays companies either use their own built in encryption or use available on internet. I was asked am interview question- how do you manage credentials for an application?

[@narapareddyjannavarapu7989]

Good and valuable information

[@javasystems5850]

HI, I have two points 1) how can a hacker can reach Heap Dump or JVM crash DUMP. We have all sort of security levels.

[@prasadsawant7]

Who knows hacker could have hire your company's employee to get to know about your system? Hacker is hacker no one can stop it unless and until everyone stops using internet.

[@iliyas868]

Thank you for sharing the knowledge. Good content but too many ads results in no sub!

[@naveenautomationlabs]

Its not in my hand. KZbin provides these ads not by me.

[@voiceover_vipul]

Naveen I have one question, if by using char array for sensitive info. And PWD is printing into the logs in a garbage value. Can't hacker decrypt it. As which algo is using.

[@Lipunknb]

Well explained 👏👌

[@niravdaskubavat328]

Is it really possible that someone can read something from heap memory ?

[@rahulk686]

Can you upload the detailed video about gradle build tool

[@sujeetgawande913]

Hi Navin as a tester how I check the password is encrypted or not

[@Inkeri94]

if we are storing hash (bcrypt) in the database it doesnt really matter if it is a string or a char array, does it?

[@appansingharoy491]

Thanks much champ 🔥🔥

[@t.a.kalsekar]

Awesome video! thanks 👍👍👍

[@amolmehlawat8197]

A video on SOLID principles sir. 😭😭

[@ashish9284]

Good job..👍🙏

[@dipanshuvishwakarma6760]

Great sir🙏🙏

[@TheGuroguro12]

Thanks

[@vinitcv127]

Except for cryptography, why? You read as string, write as string if there are more than one system involved.

[@selvadurais1791]

Is possible to take memory dump from remote ?

[@bigbosstwo4977]

Hi Naveen sir, but how can we use this feature in our testing framework ? May be an Example will be helpful. Thanks in advance

[@naveenautomationlabs]

Not for testing framework. It's a system level handling for password.

[@anuj191]

I think garbage collector does not remove from scp.. it get removes when the server gets restarted. Am i right?

[@prakashbtw678]

This was my last interview Q.

[@learnmycourse]

Good

[@sagars3332]

Cool one..

[@pargatsingh5261]

What about using a StringBuffer?

[@mayurshelke421]

Thank you

[@vikassinghal9413]

Hacker with just 2 hairs :):):)

[@shriyayadav1733]

waiting for new videos

[@jyotibaviskar6282]

I have been asked one que Strings are immutable right String str1= ABC Str str2 =def Str str1= str+str2; Sysout(str1) ; Here we are doing concatenation or appending so str1 is getting updated. So how we can say strings aste immutable. May be I am not able to explain that well the question here. But idea was like that only. I got confused. Can you elaborate this

[@naveenautomationlabs]

String str1= "ABC"; String str2 ="DEF"; str1= str1+str2; System.out.println(str1);//ABCDEF here "ABC" is a string, not str1. "ABC" is stored in the constant pool in heap memory. when you concat it with str2, and assign it to str1. str1 will start pointing to "ABCDEF". But "ABC" is still there in the pool without any change. Now there are three strings in pool: "ABC" (no reference), "DEF" has reference as str2 and "ABCDEF" is referred by str1. Hope its clear now.

[@jyotibaviskar6282]

@@naveenautomationlabs yes.. Thank you so much.

[@KOTHAABHISHEK]

@@naveenautomationlabs most of the youtubers wont respond to comments But you are amazing bro Thats why we love you bro 😍

[@yforyou1342]

@Naveen AutomationLabs sir I have a question. after changing the new string PWD then PWD will pointing to new pwd only not older one..then what if the hacker getting the older PWD from dump..it got expired and it's no use for him right. Please clarify this if my question is valid.

[@naveenautomationlabs]

Older PWD is the actual password in the system. Programmer is manipulating to a new dummy password like some random string. But this won't help as actual password is still there in the pool and can be accessed through memory dump. User is not changing the PWD here, it's programmer is changing the variable value.

[@yforyou1342]

@@naveenautomationlabs ok got it. Thankyou 🙏

[@sklondon5855]

Hi Naveen sir,I had used char to store the PWD but in console the PWD is visible, char[] c =new char[]{'N','a','v','e','e','n','@','1','2','3'}; System.out.println(c); did I missed something ,please reply

[@loganathansubbaiyan8002]

Same here. Are you able to fix that issue

[@skamirullah]

Hey, Solution1: System.out.println(c.toString()); Solution2: System.out.println("Any String"+c); Your code is correct you will just have to covert 'c' to string or concatenate it with any String

[@nadeemqureshi9779]

This is too much optimization ..

[@crickettales6594]

🙏🙏🙏

[@shriyayadav1733]

First comment

[@akshayverma6216]

First thing scp and heap are two different sections of memory. Scp is not inside heap. 😘😘😘

[@naveenautomationlabs]

You really need to learn about heap in java. Scp is part of heap only which is garbage collected by JVM.

[@akshayverma6216]

@@naveenautomationlabs yes you seem to be correct from 1.7 version

[@naveenautomationlabs]

Jdk 1.7 got released in 2011. Its been 10 yrs now. Upgrade your java version and don't read blogs who still refer jdk 7.

[@akshayverma6216]

@@naveenautomationlabs also tell me if we do Sting s = “hello”; String s2= s.toUpperCase(); in which area s2 object will create?