Tag Info

New answers tagged

-1

can I safely assume that this application does not open a security hole on my PC? Indeed, there are some issues you have to think about: First of all, to run the pre-compiled Java application (3rd party application, as you commented), you do it at your own risks; I mean, by principle, everything that that involves trust could be a source of threat ...


3

It depends if these are security issues of the JVM or the Java libraries. Since the JVM is not used these problems don't affect compiled applications. But issues in the library might affect your application. If these issues are relevant for your program depends on the kind of issues and what your program does. For example problems affecting the validation of ...


3

The most problematic part with Java is that it offers a way to sandbox code for restricted execution but that this protection could often be bypassed in the past. Thus the main problem is the use of Java in scenarios where this sandbox gets used, which is mainly in the browser. When used instead with standalone applications and not applets the security of ...


3

Meta: this may better fit security or even superuser; if it migrates take my answer along please. How big? A (full) TDES aka DESede key contains 168 bits of "real" key, but the stored form includes bits originally reserved for parity and today often ignored totalling 192 bits = 24 octets. "Two-key TDES" (TDEA keying option 2) has 112 "real" bits, stored ...


-2

The answers about encryption are not wrong, but the approach is wrong. You should not encrypt. You should use a one way hash function. This means that you do a NON-reversible mathematical operation on the password, and store the result. When someone wants to log in, you perform the operation again on the password they supply, and compare it to the result on ...


1

Based on the limited information: At a minimum your looking layers of security you trying to accomplish. We'll call this the DMZ. This is the layer that Application A is accessed at, or more simply put, the point of entry for your setup. You don't want anyone beyond this point. The next layer is the backend. This is your application B and you are trying ...


0

Potentially you could put application A on an internal network giving it no access to the outside world (or the outside world access to it). This combined with the firewall rule Th0mas mentioned should do the trick. Edit It seems that you're really attempting to validate what is calling you, this can be done by using csrf token exchanges in your JSP, see ...


0

How about host-based firewall rules based on a whitelist? Ruleset server A: Incoming: IP (Server B) Outgoing: IP (Server B) Should do the job for applications that don't have high/very high protection requirements.


0

The direct equivalent in Java would been using class loaders or implementing an interpreter particularly if it allows arbitrary method calls through reflection. An IDE or other code viewer that allows tracing back method calls will show you APIs that indirectly use this (or use grep). Oracle's Secure Coding Guidelines for Java SE has a list of examples in ...



Top 50 recent answers are included