42565

QLineEdit password safety

In my application user types his password in QLineEdit. QLineEdit works in Password echo mode.

Application must clear password from memory when it is no longer needed.

Does QLineEdit make sure that it clears all its internal memory buffers before they are freed? I cannot found such information in documentation.

If QLineEdit does not clear its content then what is the simplest way to implement such behavior? I want to reuse QLineEdit functionality as much as possible and do not want to implement my own password edit control from scratch. Is it possible?

Answer1:

Note that even when calling setText({}) is not completely safe - the string might get written to swap space if your application is swapped out. The only way to prevent that is to allocate the memory for the internal string of the lineedit yourself and call mlock() on it to prevent swapping. For that you need to write your own lineedit.

In addition, the text is quite trivial to figure out when attaching a run-time introspection tool like Gammaray to your application, as it is a normal QObject property, and stored unobfuscated in RAM.

Also, by looking at the implementation of QWidgetLineControl::internalSetText (see the code), it seems like the line edit text is made available for the accessibility interface, which is accessible to everyone unless accessibility support was not compiled into Qt.

So, depending on your security level, you do need your own implementation.

Answer2:

I think calling

QLineEdit::setText("");

will do the job. As Qt documentation says:

Setting this property clears the selection, clears the undo/redo history, moves the cursor to the end of the line and resets the modified property to false.

In opposite, calling QLineEdit::clear() will clear only text, however Undo/Redo stack will still contain the previous text.

Recommend

  • PhoneStateListener doesn't call
  • Textview values does not update when data received from Arduino
  • How can I accept “unsafe” HTTP response headers in a Windows Phone/Store app?
  • Determining signed state for HDF5 variables in NetCDF
  • Is there a filesystem plugin available for django?
  • How to reuse eclipse launch file in a new project
  • How can I create, read, update and delete Mediawiki articles via scripts?
  • Why is this code not working? Hangman
  • wrong item changes in recyclerview
  • How to exclude files in a custom clean task?
  • UIScrollView setContentOffset: animated: not working
  • Whats the right place for testhelper-classes? (phpunit/best practise)
  • Django AWS S3 Invalid certificate when using bucket name “.”
  • How to replace TouchesBegan with UIGestureRecognizer
  • Yii2 Login with database
  • Is there any way of quickening monkeyrunner script execution?
  • Does the Azure table storage API cache results?
  • text-align justify, cannot override
  • init_seg and warning C4073 from library code?
  • What's the name of this finding square root algorithm?
  • iOS Localization Doesn't Work with More Than 63 Files
  • why calling cd shell command through system() or execvp() from a child process won't work?
  • Better Indy for Dephi 2007
  • Compare struct to a constant in C
  • unable to get jsonEncode in magento2
  • Creating PDF from TIFF image using iText
  • vectorized indexing/slicing in numpy/scipy?
  • Wrong labels when plotting a time series pandas dataframe with matplotlib
  • Cast between interfaces whose interface signatures are same
  • as3-flash: any way to access all the instances placed in different frames from document class?
  • Scala multiline string placeholder
  • Android application: how to use the camera and grab the image bytes?
  • How to use carriage return with multiple line?
  • Cancel a live stream “fast motion” catch-up in Flash
  • QLineEdit password safety
  • Validaiting emails with Net.Mail MailAddress
  • Which linear programming package should I use for high numbers of constraints and “warm starts” [clo
  • Javascript + PHP Encryption with pidCrypt
  • Why winpcap requires both .lib and .dll to run?
  • How to CLICK on IE download dialog box i.e.(Open, Save, Save As…)