In garbage collecting languages (JavaScript), can I securely overwrite data?

Question

Realizing that garbage collection and memory management is implemented differently in different environments for sake of simplicity this question will focus on JavaScript (either V8 or Seamonkey).

I realize that garbage collection is a means to determine if a portion of memory needs to be deallocated or not. The simplest example I know of is setting a variable to null:

var x = 'foobar';
// x)-┐
//    V
//   ┌-┬-┬-┬-┬-┬-┐
//   |f|o|o|b|a|r|
//   └-┴-┴-┴-┴-┴-┘
x = null;
// x)--> null
//
//   ┌-┬-┬-┬-┬-┬-┐
//   |f|o|o|b|a|r| Eligible to be garbage collected
//   └-┴-┴-┴-┴-┴-┘

So I was musing how can I securely change the value so that it isn't available to poking? I realize this is a purely contrived example. The reason I ask is to better understand how memory is allocated in JavaScript and if there are methods of data manipulation that would avoid reallocation of memory leaving some of it littering up the free memory space.

In other words can I change the memory values in JavaScript or is reassignment the only way leaving it in free memory?

To further illustrate my contrived example, let's say I want to store a password but then securely obfuscate it before I send it into garbage collector land. I believe Reassignment would look like this:

var x = 'foobar';
// x)-┐
//    V
//   ┌-┬-┬-┬-┬-┬-┐
//   |f|o|o|b|a|r|
//   └-┴-┴-┴-┴-┴-┘
x = '******';
// x)--------------┐
//                 V
//   ┌-┬-┬-┬-┬-┬-┐┌-┬-┬-┬-┬-┬-┐
//   |f|o|o|b|a|r||*|*|*|*|*|*|
//   └-┴-┴-┴-┴-┴-┘└-┴-┴-┴-┴-┴-┘
//    \_________/
//         |
//         Eligible for garbage collection
x = null;
// x)--> null
//
//   ┌-┬-┬-┬-┬-┬-┐┌-┬-┬-┬-┬-┬-┐
//   |f|o|o|b|a|r||*|*|*|*|*|*|
//   └-┴-┴-┴-┴-┴-┘└-┴-┴-┴-┴-┴-┘
//    \_________/  \_________/
//         |            |
//         Eligible for garbage collection

So can I manipulate the first memory partition so that the values are not left in memory unreferenced but instead replaced so a memory scan would find the replacement instead of the old value?

Answer 1

"So I was musing how can I securely change the value so that it isn't available to poking?"

you can't. You have no access to the actual memory location where the data is stored, so you can't determine where you're writing.
The attempt to overwrite the data is likely to write to another location entirely.

Answer 2

So I was musing how can I securely change the value so that it isn't available to poking?

In JavaScript, you cannot. However, there is a need to delete sensitive data, so other languages have workarounds. For example, in Java 8 the Destroyable interface was added so that sensitive objects can be cleanly destroyed, but this requires implementation support. Currently, JavaScript does not support anything like this. Garbage collection does not make it impossible to protect sensitive data from poking, it just requires implementation support.