Questions tagged [java]

Security aspects specific to the Java programming language, libraries, and virtual machine.

Filter by
Sorted by
Tagged with
67 votes
21 answers
70k views

Lessons learned and misconceptions regarding encryption and cryptology

Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
makerofthings7's user avatar
38 votes
8 answers
16k views

Client side password hashing

Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security. After reading through a few discussions here about client side hashing of passwords, I'm ...
Foy Stip's user avatar
  • 391
40 votes
2 answers
39k views

How should an application store its credentials

Context When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, ...
Zar's user avatar
  • 502
19 votes
7 answers
13k views

Any comprehensive solutions for binary code protection and anti-reverse-engineering? [closed]

Does anyone know of good products with comprehensive binary hardening and anti-reverse-engineering features? Or better, has anyone seen an independent review comparing products that perform these ...
Weber's user avatar
  • 1,016
7 votes
3 answers
6k views

Reference implementation of C# password hashing and verification

Does anyone have a reference implementation (ideally 3rd party certified, or government approved) way one-way hash a password for C# and or Java? Ideally,I'd like to see something that includes a "...
makerofthings7's user avatar
37 votes
8 answers
10k views

Should I worry about remote timing attacks on string comparison? [duplicate]

Say we have a Java web application which uses a shared secret to verify the identity of the client. The secret is stored on the server, and the client transmits the secret over SSL where it is checked:...
George Powell's user avatar
30 votes
7 answers
1k views

How to keep an eye on upgrades, patches and security issues for used open-source libraries?

For a project with many open-source libraries as a part of it, I began to search for information source concerning all upgrades and security issues. The kind of sources I gathered are either ...
Eldros's user avatar
  • 401
16 votes
3 answers
35k views

SSL Newbie : Does HTTPS client also need a certificate?

I am calling an HTTPS URL through a Java program. Does my Java client need to provide a certificate to the server to establish this connection? In other words, do I need my own certificate or is the ...
AbuMariam's user avatar
  • 263
13 votes
2 answers
22k views

What is the best way to store password in memory (RAM) in Java?

Imagine there is a login form in Java application. We need assign usename and password to variables. Moment after we can Hash or HMAC password and keep it just for authentication step (no caching). ...
Kasun's user avatar
  • 784
24 votes
3 answers
2k views

Should I be disabling Java?

First it was Apple, now it's the US government... U.S. urges users to disable Java; Apple disables some remotely New malware exploiting Java 7 in Windows and Unix systems How serious is this "...
Django Reinhardt's user avatar
18 votes
2 answers
18k views

Practices for storing username/password in Web applications

I have read the following question: Storing password in Java application but I don't find the answers useful for my case. So here is my question somehow related to that. I have a Java Web application ...
johnD's user avatar
  • 183
14 votes
1 answer
4k views

How many bits of entropy does an identifier contain?

According to https://www.owasp.org/index.php/Insufficient_Session-ID_Length: Assuming that the session identifiers are being generated using a good source of random numbers, we will estimate the ...
Gili's user avatar
  • 2,169
11 votes
3 answers
13k views

Reverse engineering and Java

Is java class file or jar file is easy to reverse engineer? Because java generates a class file after compilation and not exe files. Is jar and class files are easy to decompile compare to c# and C++? ...
sujeesh's user avatar
  • 464
10 votes
1 answer
8k views

How securely random is Oracle's java.security.SecureRandom

There was a lot of news in the past year about exploitable weaknesses in cryptography which originated from weak random number generators. In some cases it was negligence on side of the developers, in ...
Philipp's user avatar
  • 49.4k
9 votes
2 answers
10k views

Storing password in Java application

What is best secure way to store passwords in Java web application? I am not talking about password to the DB, so it must be stored in de-cryptable way. It’s cloud environment and I need to protect ...
AaronS's user avatar
  • 2,585
8 votes
1 answer
8k views

Do I put my subordinate (intermediate) or root CA certificate in my truststore?

I have a server using a certificate signed by my subordinate (intermediate) CA. My java based client needs to put either the intermediate or root CA cert in it's truststore so when it communicates ...
Sean Bollin's user avatar
7 votes
2 answers
16k views

Best reasonable way to store a secret safely

I'm working on a software that need to store and use secrets. These secrets can be for example: a password to connect to a database a client secret for an OAuth 2.0 client_credentials grant. I need ...
superbob's user avatar
  • 173
4 votes
1 answer
2k views

Preventing License protection circumvention in Java software

A software (written in Java) by a vendor uses DSA signature to verify that the license information is correct. It achieves this by embedding the public key in the same Java software. Legit license ...
chuacw's user avatar
  • 175
108 votes
8 answers
30k views

Why do I hear about so many Java insecurities? Are other languages more secure?

I really like the Java programming language, but I continuously hear about how insecure it is. Googling 'java insecure' or 'java vulnerabilities' brings up multiple articles talking about why you ...
gsgx's user avatar
  • 1,215
31 votes
4 answers
92k views

What is the purpose/role of the "alias" attribute in Java keystore files?

I've heard conflicting information about the purpose of the alias attribute in Java keystore files. Can someone please clarify on what exactly this attribute is, and what it should be set to when ...
Mike B's user avatar
  • 3,458
16 votes
4 answers
13k views

What's the standard way to encrypt a file with a public key in Java?

I'm writing a client app in Java that sends encrypted data back to the server. All clients have my RSA public key. Is there a standard way to encrypt a given file with it to send it back to the server?...
Jean-Philippe Pellet's user avatar
14 votes
5 answers
13k views

How can I decrypt data with Java, without hard-coding the key?

I hope this is not a chicken-egg problem or reinventing the wheel but here goes. I have a Java application that needs to access a password protected file (actually during the application startup). The ...
Jim's user avatar
  • 1,415
11 votes
4 answers
6k views

Is Java relevant to Information Security?

I'm currently studying Computer Science, where we're teached Java programming. I want to get into the IT-security field, but it seems to me that Ruby and Python are more relevant for that, so I have a ...
user37534's user avatar
  • 113
9 votes
4 answers
9k views

Any useful tools for Android source code review? [closed]

I'm wondering if anyone has some recommendations for Android source code review which is Java based. For example, reviewing an Android app for security issues. Bonus for being F/OSS. Fortify seems ...
Lizbeth's user avatar
  • 757
8 votes
2 answers
21k views

What's the best way to authenticate an user using a websocket?

I'm creating a multiplayer game(based in websockets) which runs directly from the browser and which has multiplayer functionality. Each player needs to have his own account(Username and password). ...
zearthur99's user avatar
2 votes
1 answer
602 views

Vulnerability of Java software

The JAVA software provided by Oracle is a security mess. But what exactly, in that software package is the most vulnerable. If someone install it and disables the Java plugin in the browser, will he ...
Mayank Singh's user avatar
151 votes
5 answers
522k views

How can I export my private key from a Java Keytool keystore?

I would like to export my private key from a Java Keytool keystore, so I can use it with openssl. How can I do that?
Jonas's user avatar
  • 5,203
25 votes
4 answers
74k views

Password hashing on frontend or backend? [duplicate]

I have a Java Server with Spring Boot and a JS Frontend in AngularJS. My teacher told me to use HTTPS for passwords, because I cannot hash them securely enough, that nobody can hack them. With HTTPS,...
rala's user avatar
  • 361
25 votes
5 answers
13k views

Java SecureRandom doesn't block? How?

I know from experience that reading from /dev/random blocks when the Linux kernel entropy pool runs out of entropy. Also, I've seen many articles and blog entries stating that when running on Linux, ...
user1483512's user avatar
16 votes
1 answer
17k views

Preventing Server-Side Request Forgeries in Java

The application lets users specify a URL for their profile picture. It fetches the data from the URL and saves it on the server. However, the app is vulnerable to server-side request forgery (SSRF) - ...
paj28's user avatar
  • 33.4k
15 votes
1 answer
10k views

HQL injection example

Our developers left a surprise in handling user login. Namely: // java List users = hibernate.find("from Users where username = '"+formUsername+"'"; if (users.length==0) { return BAD_USER; } if (!...
Pawel Veselov's user avatar
14 votes
3 answers
29k views

Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 a safe cipher suite to use?

Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 a safe cipher suite to use for a TLS 1.2 connection to a Tomcat server? What are potential weaknesses or better alternatives? I am looking for a cipher ...
JRA_TLL's user avatar
  • 243
13 votes
1 answer
11k views

Android Runtime Code Injection

I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
Ben Holland's user avatar
12 votes
3 answers
9k views

Is null-byte injection possible in Java filenames?

From the Area51 proposal
AviD's user avatar
  • 73.3k
11 votes
1 answer
10k views

Storage of 'secrets', keystores, HSMs and the rest

I've been digging for the past few days into storage of sentitive data. If I store this data in a database, I believe the general accepted practice is to store sensitive data encrypted, for various ...
François Lamarre's user avatar
10 votes
1 answer
3k views

Is Java vulnerable to glibc GHOST Vulnerability in Linux?

I see on our RedHat Linux platform that "java" process has dependency over glibc library: [root@hpproliant1 ~]# ldd /usr/bin/java linux-gate.so.1 => (0xffffe000) libpthread.so.0 => /lib/...
Mert Z.'s user avatar
  • 201
10 votes
1 answer
6k views

Does Oracle's GuardedString protect sensitive data against heap or memory dumps?

Oracle's org.identityconnectors.common.security.GuardedString states this in its documentation: The GuardedString class alleviates [the problem that string data is kept in memory as clear text] by ...
Chris Betti's user avatar
9 votes
2 answers
11k views

What is the best practice to store private key, salt and initialization vector in database?

I am working on java application to create a digital signature to sign a document. I already created private key and public key using (Elliptic-curve cryptography) ECC, and now I want to store both ...
Mohamad Raziman Md Dom's user avatar
9 votes
1 answer
8k views

How to select /dev/random or dev/urandom in the code in Android?

When generating randomness using SecureRandom in Android, I want to select /dev/random or /dev/urandom as the seed source. It can be done in java.security file on Linux and Windows systems but there's ...
Rubi Sharmax's user avatar
9 votes
1 answer
16k views

Encrypting data for Android mobile app

I am creating a mobile app for Android. This is my first mobile app by the way. I have decided to store data used in my app in a SQLite database in the target Android device. The data I am storing ...
Thusitha Nuwan's user avatar
8 votes
1 answer
695 views

Are there any type safe languages with deterministic compilers?

This article about BIND9 concludes with the statement: The point I'm trying to make here is that BIND9 should not be exposed to the public. It has code problems that should be unacceptable in this ...
makerofthings7's user avatar
7 votes
1 answer
8k views

Why does Java allow AES-256 bit encryption on systems without JCE unlimited strength policies if using PBE?

It's fairly standard knowledge that due to the cryptography export controls, Oracle JRE ships with "limited" cryptographic strength enabled as listed in the JCA Documentation. For AES, the default max ...
Andy's user avatar
  • 209
6 votes
3 answers
1k views

How to rate Open Source Libraries?

Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries? I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
rdmueller's user avatar
  • 2,763
5 votes
2 answers
2k views

Questions about TLS handshaking process

I am trying to understand how TLS works. Assuming the I have a java client that uses TLSv1 to communicate to the server which supports TLSv1.2, can the client talk to the server successfully? When a ...
arjunj's user avatar
  • 153
5 votes
2 answers
4k views

Does Java applets reveal the real IP address, even when using proxy or vpn?

Can a Java applet reveal the original client IP address, when browsing through a proxy or a VPN? Why?
Nameless's user avatar
5 votes
3 answers
4k views

Security of JVM for Server

Using type- and memory-safe languages like Java and Scala for server applications gave me the confidence of having a basic level of security (e.g. compared to C). Now with the recent wave of Oracle ...
jans's user avatar
  • 319
4 votes
1 answer
1k views

How to run multiple session while scanning application through Burp?

While scanning an application through Burp, I've found that if I use multiple threads, it results to session errors like The requested session id appears to be invalid. You may have more than one Task ...
siddhu619's user avatar
  • 117
4 votes
1 answer
628 views

Question about AES-CBC IVs

I'm writing a Java program that encrypts strings with AES-CBC encryption. (Eventually I'm going to add steganography functions too). As you are well aware, CBC needs an IV in order to encrypt the ...
You'reAGitForNotUsingGit's user avatar
3 votes
2 answers
3k views

Java Applet for mutual authentication with smart card

I need to develop a java applet, for a mutual authentication between Tomcat 6 (server) and a SmartCard "IDGo 300" (client). In order to do this I thought the following scheme: Tomcat (server) send ...
xfocus's user avatar
  • 31
3 votes
2 answers
2k views

How to securely send a password from one app to another app?

See this question/answer first: When calling a process from another process, Is sending stdin password more secure than sending an ENV variable? I am a Java developer that is building an app where ...
Nicholas DiPiazza's user avatar