security aspects specific to the Java programming language and libraries.
22
votes
6answers
304 views
How to keep an eye on upgrades, patches and security issues for used open-source libraries?
For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
-1
votes
1answer
158 views
Number of time steps in TOTP [closed]
I am implementing TOTP in JAVA.Formula for number of time steps is T = (Current Unix time - T0) รท X.I have taken Current Unix time:long unixTime = System.currentTimeMillis()/1000L(1335246034) and T0 ...
0
votes
2answers
2k views
Best Approach for removing XSS Vulnerability
I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like <script>alert("hi")</script> is input ...
4
votes
3answers
275 views
How to rate Open Source Libraries?
Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries?
I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
1
vote
0answers
3k views
Getting started with OWASP ESAPI + JavaEE - simple TestProject [closed]
This question was originally asked on stackoverflow
I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff?
I have a little JavaEE ...
2
votes
2answers
625 views
Secure communication between C# client and Java server, using certificates
I want to secure communication between simple C# WPF client and Java server. Now i have already implemented raw sockets communication, and my security is based on:
server send RSA public key to ...
2
votes
2answers
389 views
Securing a Ubuntu system on Amazon Web Services
I'm in the process of setting up a Ubuntu server on Amazon Web Services / EC2, which will need to host the following:
A relatively simple Java-based website (using the Noir framework)
A Java-based ...
1
vote
1answer
320 views
PAP and CHAP implementation using Java
I want to implement PAP and CHAP based authentication in my Java project how can I implement ? is there any API available in Java for using that protocol ?
3
votes
1answer
483 views
Storage of 'secrets', keystores, HSMs and the rest
I've been digging for the past few days into storage of sentitive data. If I store this data in a database, I believe the general accepted practice is to store sensitive data encrypted, for various ...
4
votes
3answers
931 views
Reverse-engineering one-time passwords for two-factor authentication systems
Given a one-time password generator that is time-based (such as Google Authenticator), how many instances of (time, PIN) pairs would one need to significantly weaken the algorithm to a point where one ...
3
votes
4answers
358 views
Base64 conversion for byte array in encryption
I am using ECC algorithm for security. Now the concern is I am placing the data in web page after encryption of the data in hex format and transmit to server and then it decrypts the data, but when I ...
3
votes
1answer
342 views
Best security algorith for storing passwords [duplicate]
Possible Duplicate:
Which password hashing method should I use?
I want the best cryptography algorithm for storing passwords in database, which one should I use and how can I implement ...
1
vote
1answer
453 views
How to best authenticate a desktop client with a scaleable backend via SOAP / REST service?
I'm trying to find a solid architecture for authenticating users against a database. I have a game client, which I plan to serve up a request with. The transport doesn't really matter, but at this ...
2
votes
1answer
111 views
Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads?
As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is ...
3
votes
2answers
344 views
Can one get infected through visiting a site with a PHP script on it and if yes, how?
I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP?
Since it's serverside it shouldn't have access to the visitor's ...
4
votes
3answers
261 views
Is this java app harmfull?
If you visit most of the "online youtube download" pages, you will get this message:
Why all these sites come up with this message? Is it a worm, or just an unharmfull app?
3
votes
1answer
365 views
Sip call Developing in android with secure data transfer
I would like to make an application similar to RedPhone on android. I took a look at SipDemo from developer.android.com and at the android.net.sip package.My question is, when you make/receive a call, ...
2
votes
3answers
2k views
What data should I validate when validating X.509 certificates using Java?
Well I began with PKI a year ago with RFID system at school. Now I'm asked to implement this in my job. I understand most part of the idea. The doubt is about the certificate validation.
I know it ...
3
votes
3answers
100 views
Identifying and preventing execution of “any” function via Late-Bound commands
The Command Pattern is widely used to create a robust, salable applications. However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the ...
4
votes
4answers
413 views
Is silverlight and Java running on the web browser capable of saving “state” into the user's local machines?
I am aware that even after we have cleared our cache and cookies, websites can still save files/information into our computer using Flash (Flash ever cookies),
I was wondering does other plugins like ...
3
votes
0answers
257 views
When to move from Container managed security to alternatives like Apache Shiro, Spring Security? [closed]
I am trying to secure my application which is built using JSF2.0.
I am confused about when do people choose to go with security alternatives like Shiro, Spring Security or owasp's esapi leaving ...
0
votes
0answers
515 views
Topics for undergrad thesis, suggestions please [closed]
I'm a CS university undergraduate student, currently in my last year of studies for my BSc (not MSc). Every student needs to submit a thesis in order to get the degree. I have the option to suggest a ...
3
votes
1answer
379 views
Securing sensitive data in a DB,is using H2 worth it?
I am designing a web application at the moment, and one of the requirements is to secure the user credentials as well as their roles. Now ofc besides the usual pwd hashing + salt +.... I was thinking ...
17
votes
3answers
3k views
Deleting a Java Object securely
I know that in order to delete a Java object I should use character array instead of String, since I can safely erase (rewrite the character array with other data) its content. This seems not to be ...
4
votes
1answer
935 views
How can I store downloaded video securely to device's sd card?
I want to save videos in my android mobile's SD card securely such no other application or user can use it, outside the application or on any other devices.
So for this what can I do? I think about ...
3
votes
2answers
283 views
Building a security framework
I know there are many security frameworks and "building" a security framework is a bad idea.
In the recent project I have worked on, I used spring security to secure the web application. In the ...
5
votes
2answers
470 views
Frameworks or any Solutions for authentications/security/ login management in Java Web Applications
I am looking for a framework/solution for authentication/ user-login management/ security in java web application that can make the naive developer's job easier/faster and make the application ...
6
votes
4answers
913 views
Is there a real risk of exploitation in java code where a null pointer is dereferenced
I'm playing with some generally well written and parsed java code, but there are some oddities thrown up by my code scanning tool.
I know a null pointer dereference can crash a program, but assuming ...
4
votes
1answer
1k views
how to secure Android Market public key
Android's security manual says that it is not safe to keep market public key just as a string and it should be hidden/encoded somehow. I am new to android Can somebody please provide me with example ...
2
votes
2answers
296 views
What is the correct way to assess and compare Certicom's products to the alternatives?
I'm investigating Certicom's API because they are "free" with the Blackberry implementations, and have come to realize that I have several alternatives for implementing crypto such as BouncyCastle, ...
4
votes
2answers
1k views
Reference implementation of C# password hashing and verification
Does anyone have a reference implementation (ideally 3rd party certified, or government approved) way one-way hash a password for C# and or Java?
Ideally,I'd like to see something that includes a ...
3
votes
2answers
468 views
BlackBerry client authenticating to Java Web Service
I already asked this question at StackOverflow here: http://stackoverflow.com/questions/4970681/blackberry-app-security and was directed to this site, can anyone pitch in as to how I can solve this ...
1
vote
2answers
937 views
where can find sample coding for use of Bouncy Castle(java)?
I had found bcprov-ext-jdk16-145.jar and bcprov-jdk16-145.zip. I wish to use the IDEA encryption to encrypt XML, but i haven't found any sample of coding in JAVA. Can anyone tell me how to call the ...
8
votes
4answers
4k views
What's the standard way to encrypt a file with a public key in Java?
I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the ...
10
votes
2answers
808 views
