replace with more secure method