Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to get shared key between Firefox extension and a java program running in same machine. I am communicating both application via socket.

My assumption is that malware is running in machine which can read any files in machine and also read any port communication. This means i cannot use SSL to secure the communication as I cannot store private key any were in my machine.

For key exchange i am planning to user Diffie–Hellman key exchange. How can java application (listening to a port) can authenticate or be sure that Firefox extension has initiated the key exchange interaction and not some malware?

share|improve this question
Short answer: It's impossible. If your application is running on the same machine with a sufficiently privileged malware, you're doomed. – CodesInChaos Nov 15 '13 at 12:33
i assume malware can only read files, and also send some thing to port. Still doomed?? – amit Nov 15 '13 at 12:36
How are you assuming this theoretical (or real?) malware can only read files? Is it running as the same privileges as Firefox (and thus can read any file that Firefox can)? What are you really trying to secure here? If there is malware on the machine, it can potentially be intercepting anything this other process does (not just socket comms and files), protecting a process on a machine that's already compromised is ultimately impossible. – gregmac Feb 6 '15 at 23:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.