Java: How to make an object written to a file unreadable to humans?

Question

I have a class that stores a password (I'm going to be adding more things than just the password) called Data:

import java.io.Serializable;

public class Data implements Serializable{

    public String password = "";    

}

As a test I ran these two:

private static File datafile = new File("data.src");

public static void checkDatafile() {
        try {
            Data data = new Data();
            data.password = "Newwww";
            if (!datafile.exists()) {
                datafile.createNewFile();
                ObjectOutputStream oos = new ObjectOutputStream(
                        new FileOutputStream(datafile));
                oos.writeObject(data);
                oos.flush();
                oos.close();
            }

        } catch (IOException e) {
            e.printStackTrace();
        }
    }

public static Data loadData(Data data) {
    try {
    ObjectInputStream ois = new ObjectInputStream(new FileInputStream(datafile));
    data = (Data) ois.readObject();
    ois.close();
    } catch (IOException | ClassNotFoundException e) {
        e.printStackTrace();
    }
    return data;
}

It writes and reads perfectly but when I open the data.src in notepad it's somewhat readable by humans and the password is not secure, this is the output of data.src:

ｬ・ sr data.Data克ﾗ淕6J・ L passwordt Ljava/lang/String;xpt Newwww

The password is easily seen and is not safe, is there a way to encrypt/encode the object when writing to a file so that it's unreadable by humans?

Also, I'd rather stick to the standard Java libs then to download and use others.

Answer 1

It depends on what you mean by "unreadable". If your goal is to prevent a malicious person from extracting the password, even if they have the necessary permissions to run your program, you'll be hard-pressed to do so. After all, if a program can decrypt the password, a person with the same permissions can too. Even without appropriate permissions, a malicious user could potentially inspect raw bytes in memory and extract the password if they have access to the machine.

On the other hand, if you can reasonably trust the user, but just want to avoid having them accidentally see the password in clear-text, any number of simple schemes will work; even just serializing the string as its hex codepoints would be good enough.

If you must store the password itself, i.e. you're accessing a third-party service that requires a password, you essentially have to lock down the machine and limit its access to people you absolutely trust. There's no way around that. There are a number of resources describing encrypting passwords, but they all rely on you being able to lock out users from some part of the system, generally either the encryption key or the cypher-text.

However you likely do not need to, and should not, actually be storing the password at all. The standard way to authenticate a user is to never store their password, and instead store a one-way hash of the password. This is (theoretically) impossible to decipher back into the original password, but by hashing the password the user enters when they log in and comparing it to the hash you have on file you can verify their identity without ever knowing what their password is.

Edit: One more thing about systems which need to store actual passwords. In addition to locking down the machine, you need to create a robust audit trail that records all attempts to access the passwords. Every interaction with that machine and its data should be logged and tracked so that, in the event something goes wrong, you can inspect your audit history and understand the scope of the problem. If you don't have an audit trail you'll have to assume your system is entirely compromised, because you'll have no evidence to the contrary.

Answer 2

not via ObjectOutputStream. you'll have to use a encryption library and either encrypt the complete file, or the password.

Answer 3

You can have the Data class implement the writeObject/readObject methods to encrypt/decrypt the passwords as you read and write the object.

private void writeObject(ObjectOutputStream os) throws IOException{
     password = encrypt(password);
     os.defaultWriteObject();
}

private void readObject(ObjectOutputStream os) throws IOException{
     os.defaultReadObject();
     password = decrypt(password);
}

Where encrypt/decrypt define the ecryption/decryption algorithm you wish to use. This being said and as noted in a comment by Gregor Raýman, you might consider just hashing the passwords rather than storing them.

Answer 4

You can try encoding/decoding your content. You can use MD5 hash-functioning. There are pre-written functions and its usage is pretty simple.

The following link can help you understand how to use it in you code. http://www.asjava.com/core-java/java-md5-example/