PasswordInput.shred

Delete all textual data created by the password box. All text typed inside the box will be overwritten, except for any copies, if they were made. Clears the box.

The password box keeps a buffer of all text that has ever been written to it, in order to store and display its content. The security implication is that, even if the password is no longer needed, it will remain in program memory, exposing it as a possible target for attackers, in case [memory corruption vulnerabilities][1] are found. Even if collected by the garbage collector, the value will remain untouched until the same spot in memory is reused, so in order to increase the security of a program, passwords should thus be *shredded* after usage, explicitly overwriting their contents.

Do note that shredding is never performed automatically — this function has to be called explicitly. Furthermore, text provided through different means than explicit input or push(Rope) will not be cleared.

[1]: https://en.wikipedia.org/wiki/Memory_safety

class PasswordInput
void
shred
()

Meta