note 39682 deleted from security.database by didou

Note Submitter: andreas.krueger@famsik.de ---- > On a completely different note, I think yet another good way to > secure passwords, etc. from being readable by someone with > access to the server is to place them in functions in compiled files > so that they are not just plain text. That might look secure, but it isn't -- imho worse than simply doing away with it. An attacker would copy the .jar or .class file to her home machine, and rig up a small Java program at leisure to issues the same calls as does your application. Alternatively, the strings themselves can extracted from those files, with a hex editor or similar. The .class and .jar file formats are well documented. Reading that documentation an attacker would know precisely where to look.