During deserialization, the private state of the object is restored. For example, a file descriptor contains a handle that provides access to an operating system resource. Being able to forge a file descriptor would allow some forms of illegal access, since restoring state is done from a stream. Therefore the serializing runtime must take the conservative approach and not trust the stream to contain only valid representations of objects. To avoid compromising a class, you must provide either that the sensitive state of an object must not be restored from the stream or that it must be reverified by the class.
Several techniques are available to protect sensitive data in classes.
The easiest is to mark fields that contain sensitive data as private transient . Marking the field will prevent the state from appearing in the stream and from being restored during deserialization. Particularly sensitive classes should not be serialized. To accomplish this, the object should not implement either the Serializable or Externalizable interface. Some classes may find it beneficial to allow writing and reading but to specifically handle and revalidate the state as it is deserialized.