Erasing passwords from ram?

Dukc ajieskola at gmail.com
Tue Apr 30 08:15:15 UTC 2019


I am currently programming a server. So I got the idea that after 
I've generated all the hashes I need from a password, I want to 
erase it from RAM before discarding it, just to be sure it won't 
float around if the server memory is exposed to spyware by some 
buffer overflow. Is this wise caution, or just being too paranoid?

And if it is worthwhile, do I have to do this:
```
foreach(ref part; cast(ubyte[]) rootPassword) 
volatileStore(&part, 0);
```

Or, can I rely on that the compiler won't optimize this out?
```
rootPassword[] = '\0'
```

`rootPassword` is allocated on the heap, but only locally 
referred to.


More information about the Digitalmars-d-learn mailing list