security aspects specific to the Java programming language and libraries.

learn more… | top users | synonyms

3
votes
2answers
180 views

Secure way to store application settings

What is a proper or, if possible to tell, the best way to store configuration in matters of security? So far I can tell that a database with very restricted access is a good way, but please let's ...
1
vote
2answers
107 views

Best way to securely store passwords for local use?

I am writing a Java application who needs three username/password pairs. I would like to add a "remember me" feature, implying I would have to store passwords on the user's computer. Knowing this ...
7
votes
1answer
235 views

Security Risks of BD+

I have recently been reading about the DRM measures on commercial bluray disks, in particular BD+. It seems that this technology involves Java software running in a virtual machine, with full access ...
3
votes
1answer
274 views

Session fixation in Java

In the process of developing a vulnerable jsp/servlet based application I made an attempt to introduce the session fixation vulnerability. Referring to the documentation I came up with the following ...
1
vote
1answer
197 views

Can a Java servlet filter be used to pull out scripts that aren't whitelisted?

I might be asking a similar question to this: Whitelisting DOM elements to defeat XSS But I think my proposed solution is different and I was wondering if I could get the community to comment on ...
-1
votes
1answer
74 views

Exchange of encrypted files through a server

I have a thing to do, that basically bases on a server that is honest but curious. Therefore I want the server to have the public key for encryption and it will encrypt files during the process of ...
-1
votes
1answer
79 views

How can I get confirmation of new security problem in struts2?

I just read about this new struts2 security problem. I want to tell our developers to patch it, but I wish for some more sources first. The only source he cites is in another language. I guess I ...
2
votes
0answers
113 views

Grant permission to read java home from untrusted java code

I'm loading untrusted code at runtime and for this reason I'm also writing a custom SecurityManager. This untrusted code however lazy-loads some JRE classes that I do not want to block. Would it be ...
1
vote
0answers
28 views

OCSP stapling implementation in JAVA/ Android

I am trying to implement OCSP stapling in JAVA. How can this be implemented ? How can we set OCSPStatusRequest extension for TLS. and how we can verify the response ? Hi, How can we implement OCSP ...
1
vote
0answers
22 views

JKS - Keystore protection and configuration file

It appears that Java Keystore is often used by web server using a configuration file, with the password opening the JKS written in it and also the password protecting the specific entry. How could ...
1
vote
0answers
33 views

Through signing process with HSM Luna, What device perform the signing?

I'v succesfully configure and test character String signin usign Java and HSM Luna SA through PKCS11. My question is, In wich processor cryptographic operations are perform? In wich way HSM Luna ...
1
vote
0answers
30 views

Setup local Certificate Authority & integrate with SCEP

I want setup local Certificate Authority and issue X.509 certificates under my CA. In order to achieve this I am exploring following options such as: OpenSSL/OpenCA BouncyCastle Cryptographic APIs ...
1
vote
0answers
220 views

Best approach for storing banking information

I am currently developing an auction desktop application. At the moment I am storing the buyer and vendor information in 2 separate tables within a MySQL Database. Currently the data for these tables ...
1
vote
0answers
443 views

Share and store RSA - public key in java server and vice versa

My requirements are: Requirement 1: Share public key to java server. Steps: Generate public-private keys in iOS app. Store the generated keys in keychain. Send generated public key to java server. ...
1
vote
0answers
105 views

Need help to Webservice in Axis2 with https in java

I have written my webservice with https. but as per requirement i should provide authentication. so thought of going with https ssl. could any one help me with steps like moving http to https and ssl ...
1
vote
0answers
54 views

Should we allow JSPs to change on a running application server?

Should we allow JSPs to change on a running application server on a production system? My gut feeling is no. However, I can't seem to find any information to justify it. From a performance end, ...
0
votes
0answers
28 views

What is the difference of TrustManager PKIX and SunX509?

Java's JSSE provides two different TrustManagers: PKIX and SunX509 I tried to find out what the differences between both are, but couldn't find any in the documentation. Can you tell me the ...
0
votes
0answers
144 views

Java Updates Restrict Unsafe SSL Renegotiation With Active Directory Servers

We have two active directory (AD) hosts, ead01.domain.com and ead02.domain.com; we also have a corresponding service domain, at eadauth.domain.com which round-robins between these AD hosts (via DNS). ...
0
votes
0answers
72 views

Considerations for using in-memory file system in a Java web application?

I was reviewing some code for a Java based web application accessible by authenticated users. It used the file system to work with temporary files, some of which have sensitive data. The input is a ...
0
votes
0answers
79 views

What curve and key length to use in ECDSA with BouncyCastle

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...