Tip To Developers … Avoid Using Immutable Types for Passwords and Sensitive User Data

Here is a discussion with a developer on their code …

“Why have you stored the passwords as string?”, “Passwords are just strings. What’s the problem?”, “Well, strings are immutable objects”. “But I allocate a null string after I use it, so it’s okay!”, “But that doesn’t actually erase it from memory”. “Yes, it does”, “No, it doesn’t”. Etc.

Mutable and immutable

Our software world has moved to use objects, and these objects can be mutable or immutable. In Python, the predefined types such as int, float, bool, and str are immutable, whereas user-defined classes which are defined as mutable. When an object is created it is assigned a unique object identifier and is defined by a given type. There are then no changes allowed for an immutable object, but a mutable object can have its state changed.

In Python, we can determine the memory location of an object by using the id() function. In the following, we allocate two strings, and then determine their memory location: