security aspects specific to the Java programming language and libraries.

learn more… | top users | synonyms

5
votes
3answers
376 views

How to rate Open Source Libraries?

Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries? I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
4
votes
0answers
11k views

Getting started with OWASP ESAPI + JavaEE - simple TestProject [closed]

This question was originally asked on stackoverflow I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff? I have a little JavaEE ...
3
votes
2answers
1k views

Secure communication between C# client and Java server, using certificates

I want to secure communication between simple C# WPF client and Java server. Now i have already implemented raw sockets communication, and my security is based on: server send RSA public key to ...
3
votes
2answers
1k views

Securing a Ubuntu system on Amazon Web Services

I'm in the process of setting up a Ubuntu server on Amazon Web Services / EC2, which will need to host the following: A relatively simple Java-based website (using the Noir framework) A Java-based ...
1
vote
1answer
602 views

PAP and CHAP implementation using Java

I want to implement PAP and CHAP based authentication in my Java project how can I implement ? is there any API available in Java for using that protocol ?
3
votes
1answer
2k views

Storage of 'secrets', keystores, HSMs and the rest

I've been digging for the past few days into storage of sentitive data. If I store this data in a database, I believe the general accepted practice is to store sensitive data encrypted, for various ...
4
votes
3answers
2k views

Reverse-engineering one-time passwords for two-factor authentication systems

Given a one-time password generator that is time-based (such as Google Authenticator), how many instances of (time, PIN) pairs would one need to significantly weaken the algorithm to a point where one ...
3
votes
4answers
492 views

Base64 conversion for byte array in encryption

I am using ECC algorithm for security. Now the concern is I am placing the data in web page after encryption of the data in hex format and transmit to server and then it decrypts the data, but when I ...
3
votes
1answer
452 views

Best security algorith for storing passwords [duplicate]

Possible Duplicate: Which password hashing method should I use? I want the best cryptography algorithm for storing passwords in database, which one should I use and how can I implement ...
1
vote
1answer
879 views

How to best authenticate a desktop client with a scaleable backend via SOAP / REST service?

I'm trying to find a solid architecture for authenticating users against a database. I have a game client, which I plan to serve up a request with. The transport doesn't really matter, but at this ...
2
votes
1answer
147 views

Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads?

As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is ...
4
votes
2answers
512 views

Can one get infected through visiting a site with a PHP script on it and if yes, how?

I can imagine a clientside JavaScript that gets executed in a vulnerable browser to do some harm, but how can this be done with PHP? Since it's serverside it shouldn't have access to the visitor's ...
3
votes
1answer
648 views

Sip call Developing in android with secure data transfer

I would like to make an application similar to RedPhone on android. I took a look at SipDemo from developer.android.com and at the android.net.sip package.My question is, when you make/receive a call, ...
4
votes
3answers
6k views

What data should I validate when validating X.509 certificates using Java?

Well I began with PKI a year ago with RFID system at school. Now I'm asked to implement this in my job. I understand most part of the idea. The doubt is about the certificate validation. I know it ...
2
votes
3answers
152 views

Identifying and preventing execution of “any” function via Late-Bound commands

The Command Pattern is widely used to create a robust, salable applications. However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the ...
4
votes
4answers
538 views

Is silverlight and Java running on the web browser capable of saving “state” into the user's local machines?

I am aware that even after we have cleared our cache and cookies, websites can still save files/information into our computer using Flash (Flash ever cookies), I was wondering does other plugins like ...
3
votes
0answers
427 views

When to move from Container managed security to alternatives like Apache Shiro, Spring Security? [closed]

I am trying to secure my application which is built using JSF2.0. I am confused about when do people choose to go with security alternatives like Shiro, Spring Security or owasp's esapi leaving ...
18
votes
3answers
5k views

Deleting a Java Object securely

I know that in order to delete a Java object I should use character array instead of String, since I can safely erase (rewrite the character array with other data) its content. This seems not to be ...
4
votes
1answer
1k views

How can I store downloaded video securely to device's sd card?

I want to save videos in my android mobile's SD card securely such no other application or user can use it, outside the application or on any other devices. So for this what can I do? I think about ...
3
votes
2answers
305 views

Building a security framework

I know there are many security frameworks and "building" a security framework is a bad idea. In the recent project I have worked on, I used spring security to secure the web application. In the ...
5
votes
2answers
1k views

Frameworks or any Solutions for authentications/security/ login management in Java Web Applications

I am looking for a framework/solution for authentication/ user-login management/ security in java web application that can make the naive developer's job easier/faster and make the application ...
4
votes
1answer
2k views

how to secure Android Market public key

Android's security manual says that it is not safe to keep market public key just as a string and it should be hidden/encoded somehow. I am new to android Can somebody please provide me with example ...
2
votes
2answers
362 views

What is the correct way to assess and compare Certicom's products to the alternatives?

I'm investigating Certicom's API because they are "free" with the Blackberry implementations, and have come to realize that I have several alternatives for implementing crypto such as BouncyCastle, ...
5
votes
2answers
2k views

Reference implementation of C# password hashing and verification

Does anyone have a reference implementation (ideally 3rd party certified, or government approved) way one-way hash a password for C# and or Java? Ideally,I'd like to see something that includes a ...
3
votes
2answers
518 views

BlackBerry client authenticating to Java Web Service

I already asked this question at StackOverflow here: http://stackoverflow.com/questions/4970681/blackberry-app-security and was directed to this site, can anyone pitch in as to how I can solve this ...
2
votes
2answers
2k views

where can find sample coding for use of Bouncy Castle(java)?

I had found bcprov-ext-jdk16-145.jar and bcprov-jdk16-145.zip. I wish to use the IDEA encryption to encrypt XML, but i haven't found any sample of coding in JAVA. Can anyone tell me how to call the ...
10
votes
4answers
7k views

What's the standard way to encrypt a file with a public key in Java?

I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the ...