Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.java.programmer > #39905
| From | Andreas Leitgeb <avl@logic.at> |
|---|---|
| Newsgroups | comp.lang.java.programmer |
| Subject | Re: Alternative for properties like javax.net.ssl.trustStorePassword ... |
| Date | 2023-01-31 23:51 +0000 |
| Organization | A noiseless patient Spider |
| Message-ID | <slrnttjabt.pa7s.avl@logic.at> (permalink) |
| References | <slrntt5jd0.pa7s.avl@logic.at> <tqusjt$1bq63$1@dont-email.me> |
Arne Vajhøj <arne@vajhoej.dk> wrote:
> On 1/26/2023 1:59 PM, Andreas Leitgeb wrote:
>> Any ideas? Is passing a password as argument to a process nothing to worry
>> about?
> A password in visible plain text is at least a potential problem.
>
> You have some code that are not yours that use this property.
> Your regular code that runs later cannot change that property when needed.
> You need to get some code to run before the code using this property.
> Startup servlet may be too unreliable timing wise.
> Some googling indicate that a ServletContextListener and doing
> it in contextInitialized may be better.
Actually, my hope was, that I wouldn't really need any own code for
that at all.
Alternatives could in principle be:
- newer properties with an extra level of indirection for the sensible
data, ideally understood by the same (java crypto internal) code
that currently reads these "indiscrete" properties...
I didn't find any from googling, but that doesn't necessarily mean
that there couldn't be any.
- Given that my app runs in tomcat, maybe tomcat already has a way to
specify properties in its configuration (outside setenv.sh)...
(I didn't think of that until e.d.programmer mentioned tomcat config
in his followup. I'm not sure if he meant it that way: as defining
properties somewhere inside e.g. the xmls or some property-files that
would be read by tomcat after startup)
- maybe others...
Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Alternative for properties like javax.net.ssl.trustStorePassword ... Andreas Leitgeb <avl@logic.at> - 2023-01-26 18:59 +0000
Re: Alternative for properties like javax.net.ssl.trustStorePassword ... "e.d.pro...@gmail.com" <e.d.programmer@gmail.com> - 2023-01-26 12:50 -0800
Re: Alternative for properties like javax.net.ssl.trustStorePassword ... Andreas Leitgeb <avl@logic.at> - 2023-01-31 23:30 +0000
Re: Alternative for properties like javax.net.ssl.trustStorePassword ... "e.d.pro...@gmail.com" <e.d.programmer@gmail.com> - 2023-02-01 04:25 -0800
Re: Alternative for properties like javax.net.ssl.trustStorePassword ... Arne Vajhøj <arne@vajhoej.dk> - 2023-01-26 16:50 -0500
Re: Alternative for properties like javax.net.ssl.trustStorePassword ... Andreas Leitgeb <avl@logic.at> - 2023-01-31 23:51 +0000
Re: Alternative for properties like javax.net.ssl.trustStorePassword ... Daniele Futtorovic <da.futt.news@laposte-dot-net.invalid> - 2023-02-08 15:37 +0100
csiph-web