Java applet authenticity problem

Question

I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, how can I guarantee that is my applet who is communicating with my website ? and is not a script-kiddie that made an applet that simulates my applets behaviours in order to hack into my website.

I am having some difficulties to imagine a way to guarantee my applet authenticity to my website since this applet is developed in Java so code reverse engineering is easy and possible.

best regards,

Answer 1

Basically you cannot have such a guarantee. Your applet runs on the client machine, i.e. the attacker's machine. He can inspect the applet code as he wishes, and there is nothing which the applet can hide from the attacker since that's his computer. That the applet is compiled is no big hindrance; reverse engineering works in general, and for Java code in particular it works very well.

(A lot of people in the media industry -- movies, music... -- would be very interested if someone could come out with a solution to your problem. Right now they are still waiting.)

To ensure that only your code runs on the client machine, you have to make sure that the client machine is a closed environment, where the machine owner himself cannot insert arbitrary code of his own. That's the model of game consoles and iPhones (until jailbreak occurs, of course). You cannot have that on PC.