34

I'm developing an application which read some data from a db. The connection to the db is performed through standard login/password mechanism.

The problem is: how to store the db password? If I store it as a class member, it can be easily retrieved through a decompiling operation.

I think that obfuscation doesn't solve the problem, since a string password can be found easily also in obfuscated code .

Anyone has suggestions?

Improve this question
5
  • 3
    Is it your database, or the customer's database. If it's the customer's database, he should know its password. If it's your database, where is it located? Why would a customer application directly access the database, without going through some server where the password is stored, and where the bytecode is unavailable to clients?
    – JB Nizet
    Commented Nov 19, 2011 at 15:46
  • 1
    I usually store it hard-coded in my application as a String encrypted with Rot13. (joking).
    – Hovercraft Full Of Eels
    Commented Nov 19, 2011 at 15:48
  • If you are using Java EE, there are some standard mechanisms to deal with this... but I guess you are not. I don't think it helps security to hide the password if your application gives full access to the db.
    – toto2
    Commented Nov 19, 2011 at 15:59
  • Related question: stackoverflow.com/questions/992019/…
    – Aaron Digulla
    Commented Oct 8, 2014 at 7:32
  • You can use Java Keystore API to securely store passwords in Java. Here is an article about it: camelcodes.net/securely-manage-passwords-in-java-applications
    – moolsbytheway
    Commented Mar 8, 2023 at 8:11

3 Answers 3

Reset to default
26

Never hard-code passwords into your code. This was brought up recently in the Top 25 Most Dangerous Programming Mistakes

Hard-coding a secret account and password into your software is extremely convenient -- for skilled reverse engineers. If the password is the same across all your software, then every customer becomes vulnerable when that password inevitably becomes known. And because it's hard-coded, it's a huge pain to fix.

You should store configuration information, including passwords, in a separate file that the application reads when it starts. That is the only real way to prevent the password from leaking as a result of decompilation (never compile it into the binary to begin with).

See this wonderful answer for more detailed explanation : By William Brendel

Improve this answer
1
  • I'm facing this problem and I'm working in a offline/distributable/standalone application that any user can install in his PC where he is administrator. It means there is no secure way to hide the db credential of an application in this situation?
    – Tobia
    Commented Apr 19 at 7:12
1

For a small and simple app where you don't want to involve a lot of other security measures, this should probably be a configuration option. When you deploy your application, it could read a configuration file where the database connection properties are specified. This means that application per se doesn't know the password, but you need to gain access to the server to find the password.

Improve this answer
1

Some datas should be configurable. Just now as you told, it may be a username and password or some common datas; Normally what we do is creating a property-configuration page. What I used to do is use an XML file, keep your password/username in some encrypted format. You can easily parse an XML to retrieve your password for connectivity.

This ensures the reliability that your passwords can be changed at any time. This refers not to passwords only. but any data that you use, which is to be configured from time to time.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.