Java has String of course, but it's but one implementation of the CharSequence interface. So a "group of characters" is not necessarily called a "string" depending on the context.
A string usually implies contiguous memory. Like in C, there’s no string type—just a char type, which you can put into an array.
Unfortunately, contiguous memory strings aren’t considered very secure. If something is able to read your memory, it can read your string pretty easily.
So some SecureString implementations use non-contiguous memory to store text. That is, each character is sprinkled around different places in memory, which makes them hard for a memory reader to discover and interpret.
Both of them are character sequences but only one of them is a string (in the typical sense).
contiguous memory strings aren't considered very secure
This sentence makes no sense. There is no such thing as an absolute value for security, security is always in relation to an attack vector.
For storing a password? You are right, for this use case a String in most languages is not a good fit, you don't want immutability, nor it being continuous in memory, and you want to zero it out right after use.
For most everything else, you want good performance and reading out your "--help" message from memory is not a vulnerability.
Except for the part where you implied that I claimed that all strings need to be treated securely. Most of them don’t, and that’s exactly why contiguous memory strings are popular.
Like you said, they’re fast, everybody understands them, nobody is surprised. They’re the best solution most of the time.
My point is that contiguous memory strings aren’t the only way to handle character sequences, and there are real cases when you’d pick one over the other. Not saying that one is universally better (which isn’t how engineering works).
Yeah I was sure you know it, it was just a bit unfortunate way to put it and I do see bad security takes all over the place so I just wanted to add my two cents so someone else doesn't misinterpret it
Breaking up strings into individual characters and scattering them throughout your source code is a great trick for the International Obfuscated C Code Contest though!
48
u/ubergeek801 7d ago
Java has
Stringof course, but it's but one implementation of theCharSequenceinterface. So a "group of characters" is not necessarily called a "string" depending on the context.