Singleton Instance returns null

Question

In my application, I use the users password as the encryption key for encryption media. I am encrypting media using PBEWithMD5AndDES and this works fine with a password stored in shared preferences. Now to achieve a level of security I am removing the password from shared preferences and using a singleton that is only kept alive during the app session (as the app logs out automatically requiring entry of the password). Below is my singleton:

public class Credentials {

private static Credentials dataObject = null;

private Credentials() {
// left blank intentionally
}

public static Credentials getInstance() {
if (dataObject == null)
    dataObject = new Credentials();
return dataObject;
}

private char[] user_password;

public char[] getUser_password() {

return user_password;
}

 public void setUser_password(char[] user_password) {

this.user_password = user_password;
}
}

The password is zeroed out from memory if the app logs out, or is log out by the user or gets destroyed. However at times I am getting a null pointer when trying to retrieve the password.

   char[] pswd = Credentials.getInstance().getUser_password();

What could be causing this? is there any other method I can use except a singleton?

Answer 1

Alternatively, you can store the password using built-in Sqlite db, though I'd still recommend you save it encrypted for max protection. You can do this in 4 steps:

2) Create an entity object to store the password:

public class Password {
    int password_id; // will be auto-increamted
    String password;

    public Password(int password_id, String password) {
        this.password_id = password_id;
        this.password = password;
    }
// getter/setters ...
}

2) Create an Sqlite utility object:

public class SQLiteDBAdapter {

    protected static final String DATABASE_NAME = "mydb";
    protected static final int DATABASE_VERSION = 1;

    protected Context context;
    protected static DatabaseHelper mDbHelper;

    public static final String TABLE_PASSWORD = "tbl_password";
    // columns
    public static final String PASSWORD_ID = "_id";
    public static final String PASSWORD = "password";
    // create table string
    private static final String CREATE_TABLE_PASSWORD =
            "CREATE TABLE if not exists " + TABLE_PASSWORD + " ( " +
                    PASSWORD_ID + " INTEGER PRIMARY KEY AUTOINCREMENT, " +
                    PASSWORD + " TEXT NOT NULL);";

    public SQLiteDBAdapter(Context context) {
      context = context.getApplicationContext();
    }

    public SQLiteDatabase openDb() {
      if (mDbHelper == null) {
          mDbHelper = new DatabaseHelper(mContext);
      }
      return mDbHelper.getWritableDatabase();
    }

    protected static class DatabaseHelper extends SQLiteOpenHelper {
      // -------------------------------------------------------------------------------------------
      public DatabaseHelper(Context context) {
          super(context, DATABASE_NAME, null, DATABASE_VERSION);
      }
      // -------------------------------------------------------------------------------------------
      @Override
      public void onCreate(SQLiteDatabase db) {
          db.execSQL(CREATE_TABLE_PASSWORD);
      }
      // -------------------------------------------------------------------------------------------
      @Override
      public void onUpgrade(SQLiteDatabase db, int oldVersion, int newVersion) {
          Log.w(TAG, "Upgrading database from version " + oldVersion + " to " +
                  newVersion + ", which will destroy all old data");
          db.execSQL("DROP TABLE IF EXISTS routes");
          onCreate(db);
      }
    }
}

3) Extend an Sqlite object to manipulate the table (CRUD operations):

public class PasswordDbAdapter extends SQLiteDBAdapter {

    private SQLiteDatabase db;

    // these are column corresponding indices
    public static final int INDEX_PASSWORD_ID = 0;  // an auto-increment
    public static final int INDEX_PASSWORD = 1;

    public PasswordDbAdapter(Context context) {
        super(context);
    }

    public void addPassword(String password) {
        db = openDb();
        ContentValues values = new ContentValues();
        values.put(PASSWORD, password);
        db.insert(TABLE_PASSWORD, null, values);
    }

    public void updatePassword(String password) {
        db = openDb();
        ContentValues values = new ContentValues();
        values.put(PASSWORD, password);
        db.update(TABLE_PASSWORD, values, null);
    }

    public void deletePassword() {
        db = openDb();
        db.delete(TABLE_PASSWORD, null, null);
    }

    public boolean isEmpty() {
        db = openDb();
        boolean empty = true;
        Cursor cur = db.rawQuery("SELECT COUNT(*) FROM " + TABLE_PASSWORD, null);
        if (cur != null && cur.moveToFirst()) {
            empty = (cur.getInt (0) == 0);
        }
        cur.close();
        return empty;
    }

    public Password fetchPassword() {   // ok because there's only one password record
        db = openDb();
        Cursor cursor = db.query(TABLE_PASSWORD, new String[]{PASSWORD_ID, PASSWORD},
                null, null, null, null, null, null);
        if (cursor != null &&
            cursor.moveToFirst()) {
            return new Password(
                    cursor.getString(INDEX_PASSWORD_ID),
                    cursor.getInt(INDEX_PASSWORD));
        }
        return null;
    }
}

4) Finally, save/update/retrieve the password as desired:

public class MainActivity extends AppCompatActivity {
    private PasswordDbAdapter passwordDB; 
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        ... 
        // initialize the password db
        passwordDB = new PasswordDbAdapter(this);

        // check if password record exists
        if (passwordDB.isEmpty() {
            // save a new copy
            passwordDB.addPassword("the_password"); // more secure if it is saved encrypted
        } else {
            // update it
            passwordDB.updatePassword("the_password");
        }

    }
    ...
    public String fetchPassword() {
        return passwordDB.fetchPassword();  // or first decrypt it, then return it
    }
}