[security-dev] PicketLink IDM API - Should PasswordCredential use char[] instead of String

[Darran Lofthouse]

It is a fairly common recommended practice that passwords are stored 
using character arrays instead of String - this means that as soon as it 
is finished with the array can be cleared instead of relying on the 
garbage collector to remote the String from the heap.

Just thinking should PasswordCredential also do the same?

Regards,
Darran Lofthouse.