New answers tagged appsec
5
Yes, this can be done under the right circumstances via deserialization.
Your jar file must have a serializable class which can be used in a gadget chain
Your jar file must be on the classpath
An attacker must be able to provide data that your application deserializes
The attacker provides that data, referencing the class in your jar file in the serialized ...
0
As domenukk stated in his comment, the Google API key restriction prevents other users from packaging your API key in their app. It is simply a way for Google to ensure that the API calls it is receiving are coming from an application that was packaged by the developer who added said key to his Google API account.
However, as you rightly pointed out, it is ...
3
You're trying to invent a perfect DRM. That doesn't exist, and will never exist, because of one fundamental rule: Anything your software does, the person running it can use and change. Even if you added a password prompt that you had to go in and enter the password to validate it, the software is doing the password check, so the person running it can change ...
1
KMS allows you to encrypt/decrypt data without ever seeing your master keys. It makes managing encryption keys simpler because there's nothing you can do that can allow you to leak the master key.
They can also manage the choices of encryption algorithm, and the mechanism for upgrading algorithm choice. So these decisions are made for you so you can't ...
-1
What's the purpose/benefit of KMS?
KMS prevents the leaking of decryption keys, similar to a HSM, but HSM's are expensive and hard to use. KMS's are cheap and easy to use because they have API endpoints.
KMS shifts the problem of controlling access to encrypted data from a decryption key management problem (where granular access and ability to revoke access ...
1
It's probably not a security issue. For context, think about open source software. When you have an open source application, the application source code and database schema are completely public; anybody can take a look and review them in as fine a detail as they care to. Organizations stand up and run instances of that very same open source software all ...
Top 50 recent answers are included
