Tag Info

New answers tagged

3

When the user do the first login your software will ask for a new password. At this time the DB should be empty. Now you have a UserPassword and an empty DB. So the software generate a new random DBdataKey that will be used to encrypt/decrypt the DB contents. To encrypt/decrypt use one of the many known algorithms, like AES or similar one. Now you create 2 ...


4

"AES-128" means "AES used with a 128-bit key". "AES-256" means "AES used with a 256-bit key". By definition, you should use a 128-bit key with AES-128, and a 256-bit key with AES-256. What happens when you give a 256-bit key to AES-128, or a 128-bit key to AES-256 ? By all rights, it should blow up in your face. However, some implementations are more ...


1

the Java keystore contains certificate information To be more precise it contains public keys or key pairs (public and private key). The keystore is protected by a password and every private key is also protected by a password. However you are able to change or remove passwords. It's up to you. A Java keystore is like a detached keystore of a web ...


0

There are two things that you should do to solve your issue. One is look into mutual SSL. This will allow your client to authenticate your server and your server will authenticate your client avoiding repudiation. There are a few links on SE about this. Mutual SSL provides the same things as SSL, with the addition of authentication and non-repudiation ...


2

You have encountered two "hard" problems: authentication and authorization. There is plenty of information online on thes topic, but in your case I think your problem goes back to the design of the app. Let us start with two questions: How do you know whether user is allowed to post a high score? (Authorization) How do you know the connection to your ...


0

You have a few options. Honestly, you would most likely want to enable some sort of authentication, like HMAC to send the requests to make sure they are coming from your application. If you don't know about HMAC, google it, there is a lot of content. Take a look at this Security.StackExchange answer: A message authentication code (MAC) is produced from ...


3

If you are talking about the truststore, the risk isn't that someone will see or steal the certs in the truststore. The risk is that someone will add a certificate into the store which you do not want to trust. The store should be protected first protected by the OS permissions. The password is an additional protection.


1

I think it is important to have a strong password when you keep a chain of certificates in the keystore in order to perform a client-side authentication. Some servers, i.e: banking servers need client-authentication to set up a trustful connection: "proof me that you are the client that I think you are". You'll want to put these certificates in the keystore ...


0

Yes, you did keytool genkey in the file server.jks so that file contains your private key. What you need to do is, first add your cert (chain) to the JKS, THEN convert the JKS to "PFX". The p7b by itself does not contain sufficient information. The .p7b from the CA contains the cert for your server, and may contain other "chain" or "intermediate" certs ...


1

Yes, it is possible to track mouse movements with Java: http://docs.oracle.com/javase/tutorial/uiswing/events/mousemotionlistener.html Or http://stackoverflow.com/questions/18321877/tracking-mouse-movement-in-java Or http://mrbool.com/creating-a-simple-mouse-analyzer-with-java-swing/24507



Top 50 recent answers are included