Subject: Warren Buffett a Macro Investor?

From: Balance Brain Chemistry <[email-masked]>
Date: Mon, 24 Nov 2014 09:57:57 -0800

FORBES

Home > Mental Health > Warren Buffett

Wednesday, November 24, 2014

Special Report: Warren Buffet Cure Released

Research tells us that there is now a permanent solution for Neurotransmitter
Deficiencies.

Specifics of Cure > http://www.moneythrunetw.com/fezzes/nominately/execration.php

There is now a proven way to treat imbalances and deficiencies because

symptoms
of this imbalance have shown to cause addiction, obesity, impulsive
behavior and lack of motivation.

The medical community is very excited, because this can help people
that
do not fit the mold of a person with ADHD but suffers from similar symptoms.

[FBS Members Inc] Opt-out here or write

125 Sheridan St-N e w c a s t l e, WY eight two seven zero one

Where does the spec say this is implementation specific? I would intuitively think that what happens is simply undefined, especially with JIT/GC. How do you know the vulnerability is even reduced at all? Also I can't see how you can actually use the char[] without leaking more data from it. Dog May 21 '13 at 13:12

1

@Dog: You can use the char, but then clear it. The behaviour being undefined is implementation-specific in this context. (In some contexts the two are significantly different, but in this case I don't believe they are.) Jon Skeet May 21 '13 at 14:27

1

haha I was sure the answer was related to the "strings are immutable" thing- It's amazing the amount of different implications this has. Specially interesting is the fact that they will not be destroyed until the GC kicks in... rupps Jun 26 '13 at 2:18

So what I'm getting from all of this is "don't use char[] because it's not necessarily more secure, so don't pretend like it is. Use SecureString if you actually care about security on this level, otherwise just use string so security questions are raised in the future, when necessary." Christopher Harris Dec 6 '13 at 19:54

1

@ChristopherHarris: Well SecureString is better than char[], but char[] is better than String - where "better than" is an indication of the attack vectors available. Security is often about working out how much effort you want to put into stopping which attack vectors. Jon Skeet Dec 6 '13 at 19:56

Isn't that just "security through obscurity" though? It just sounds like using char[] to prevent outputting a password is avoiding the issue of security all together. How long is the password unencrypted that there is a more serious risk of outputting it? Furthermore, shouldn't a variable name of "password" tell a developer that they shouldn't print it? Lastly, we have ways of preventing objects from being serialized, so why wouldn't we prevent the serialization of objects containing unencrypted passwords? The whole thing seems a little "better than nothing", which can lead to confusion. The previous comment is assuming that not all char[] passwords will get cleared out, and if that's the case, the security of using char[] is for not. If you use SecureString, you're forced to examine each case that could be a security threat. The Type's name itself indicates to the developer that they are working with sensitive information. @ChristopherHarris:
No, it's not just security through obscurity. It's determinining which vectors are actually a risk, and making a pragmatic judgement as to how much effort to put into it. And your assumption that the developer isn't going to clear the char[] changes things completely - why would you assume such a thing? Your comments seem confused about where the attack is going to come from - we're not talking about developers doing daft things like serializing passwords; we're talking about hackers with access to the machine's memory. Jon Some of that comment was inspired by another answer. Sorry for confusing them. I'm assuming that a developer will forget to clear a char[], simply because whatever can go wrong will go wrong. Unless we create unit tests to make sure passwords don't show up in memory dumps, there's no way of knowing if all char[]s are being cleared. Personally, I'd like to see more people using SecureString so that it becomes common practice. Normal. Easy. I just don't see why a
nyone would use char[] when SecurePassword is available, except to reduce the effort it takes to code. It seems lazy. Christopher am not insisting that it is lazy. I personally see it that way at this time. Please tell me if I am being ignorant. Christopher Harris Dec 6 I have no problem with more people using SecureString. I disagree with your reading of the discussion as "don't use char[]" - yes, you've got to use it properly, but that's feasible. Note that SecureString isn't available in Portable Class Libraries, just as one example why you may not be able to use it. Jon Skeet Dec 6 '13 at 20:2

nice remark on reflection as a way to clear up string content. Nhan Feb 22 at 17:1

@JonSkeet You wrote "That means once you've created the string, if another process can dump memory, there's no way (aside from reflection) you can get rid of the data before GC kicks in." I am not getting why you choose to write another process? Shouldn't it be the same process in which you have created the String? What am I missing? Geek Mar 7 at 13:28Geek: Only that using a separate process would (I believe) be a more common attack vector than within the same process. Jon Skeet Mar 7 at 13:2\

public static void main(String args) {

Object pw = "Password";

System.out.println("String: " + pw);

pw = "Password".toCharArray();

System.out.println("Array: " + pw);

}

Prints: