security aspects specific to the Java programming language and libraries.

learn more… | top users | synonyms

6
votes
3answers
1k views

Are there any established mobile security frameworks or secure coding guidelines available?

I am looking for security frameworks and secure coding guidelines especially for mobile devices (Android and iOS). The languages I am interested in are Objective-C, JAVA and HTML5. If there are no ...
3
votes
1answer
648 views

Sip call Developing in android with secure data transfer

I would like to make an application similar to RedPhone on android. I took a look at SipDemo from developer.android.com and at the android.net.sip package.My question is, when you make/receive a call, ...
4
votes
3answers
6k views

What data should I validate when validating X.509 certificates using Java?

Well I began with PKI a year ago with RFID system at school. Now I'm asked to implement this in my job. I understand most part of the idea. The doubt is about the certificate validation. I know it ...
2
votes
3answers
152 views

Identifying and preventing execution of “any” function via Late-Bound commands

The Command Pattern is widely used to create a robust, salable applications. However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the ...
1
vote
3answers
685 views

Java vulnerability applicability

On a server running Java, can a JRE vulnerability be exploited even in cases where the named subcomponent is not used by the application? See CVE-2011-3545, for which the vulnerable subcomponent is ...
4
votes
4answers
538 views

Is silverlight and Java running on the web browser capable of saving “state” into the user's local machines?

I am aware that even after we have cleared our cache and cookies, websites can still save files/information into our computer using Flash (Flash ever cookies), I was wondering does other plugins like ...
3
votes
0answers
427 views

When to move from Container managed security to alternatives like Apache Shiro, Spring Security? [closed]

I am trying to secure my application which is built using JSF2.0. I am confused about when do people choose to go with security alternatives like Shiro, Spring Security or owasp's esapi leaving ...
3
votes
1answer
766 views

Securing sensitive data in a DB,is using H2 worth it?

I am designing a web application at the moment, and one of the requirements is to secure the user credentials as well as their roles. Now of course, besides the usual password hashing + salt +.... I ...
18
votes
3answers
5k views

Deleting a Java Object securely

I know that in order to delete a Java object I should use character array instead of String, since I can safely erase (rewrite the character array with other data) its content. This seems not to be ...
12
votes
5answers
4k views

How can I decrypt data with Java, without hard-coding the key?

I hope this is not a chicken-egg problem or reinventing the wheel but here goes. I have a Java application that needs to access a password protected file (actually during the application startup). The ...
4
votes
1answer
1k views

How can I store downloaded video securely to device's sd card?

I want to save videos in my android mobile's SD card securely such no other application or user can use it, outside the application or on any other devices. So for this what can I do? I think about ...
5
votes
2answers
1k views

Frameworks or any Solutions for authentications/security/ login management in Java Web Applications

I am looking for a framework/solution for authentication/ user-login management/ security in java web application that can make the naive developer's job easier/faster and make the application ...
3
votes
2answers
305 views

Building a security framework

I know there are many security frameworks and "building" a security framework is a bad idea. In the recent project I have worked on, I used spring security to secure the web application. In the ...
4
votes
3answers
6k views

What password-based encryption to use with standard Java 6?

Which password-based encryption method should I use in Java 6? It should be as strong as possible, but work with the default security policy file (not the export restricted one which you have to ...
4
votes
1answer
2k views

how to secure Android Market public key

Android's security manual says that it is not safe to keep market public key just as a string and it should be hidden/encoded somehow. I am new to android Can somebody please provide me with example ...
9
votes
4answers
5k views

Any useful tools for Android source code review? [closed]

I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS. Fortify seems ...
18
votes
4answers
73k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
2
votes
2answers
362 views

What is the correct way to assess and compare Certicom's products to the alternatives?

I'm investigating Certicom's API because they are "free" with the Blackberry implementations, and have come to realize that I have several alternatives for implementing crypto such as BouncyCastle, ...
7
votes
4answers
2k views

Is there a real risk of exploitation in java code where a null pointer is dereferenced

I'm playing with some generally well written and parsed java code, but there are some oddities thrown up by my code scanning tool. I know a null pointer dereference can crash a program, but assuming ...
5
votes
2answers
2k views

Reference implementation of C# password hashing and verification

Does anyone have a reference implementation (ideally 3rd party certified, or government approved) way one-way hash a password for C# and or Java? Ideally,I'd like to see something that includes a ...
3
votes
2answers
518 views

BlackBerry client authenticating to Java Web Service

I already asked this question at StackOverflow here: http://stackoverflow.com/questions/4970681/blackberry-app-security and was directed to this site, can anyone pitch in as to how I can solve this ...
2
votes
2answers
2k views

where can find sample coding for use of Bouncy Castle(java)?

I had found bcprov-ext-jdk16-145.jar and bcprov-jdk16-145.zip. I wish to use the IDEA encryption to encrypt XML, but i haven't found any sample of coding in JAVA. Can anyone tell me how to call the ...
10
votes
4answers
7k views

What's the standard way to encrypt a file with a public key in Java?

I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the ...
16
votes
7answers
4k views

Any comprehensive solutions for binary code protection and anti-reverse-engineering? [closed]

Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
6
votes
1answer
1k views

Is there any recommended Java library for penetration testing?

Does anyone have any recommendations for a good Java library which can be used for penetration testing? I once read about a library which I think was called 'Attack lib' but I can't find it anymore. ...
24
votes
6answers
430 views

How to keep an eye on upgrades, patches and security issues for used open-source libraries?

For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
11
votes
3answers
1k views

Is null-byte injection possible in Java filenames?

From the Area51 proposal