49
votes
Poor error handling source code review
I think you are correct that those issues are more related to code quality rather than security, and none of them are exploitable in any obvious way. I would not call them "vulnerabilities".
But ...
- 65.4k
48
votes
Accepted
Am I protected from Log4j vulnerability if I run Java 8u121 or newer?
No, you really need to update log4j.
Here is an excerpt from LunaSec's announcement:
According to this blog post (see translation), JDK versions greater than 6u211, 7u201, 8u191, and 11.0.1 are not ...
- 2,442
35
votes
Accepted
Client-side BCrypt, store salt and hash separately in MySQL database
The client is the attacker. Walk around your office while chanting that sentence 144 times; be sure to punctuate your diction with a small drum. That way, you will remember it.
In your server, you ...
- 172k
35
votes
Sending password from client app to server with Java
Use TLS for the connection to the server.
The purpose of securely hashing a password is to make it more difficult to attack if the database is ever stolen. It is not designed to prevent sniffing the ...
- 66.5k
33
votes
Should I worry about remote timing attacks on string comparison?
There are published successes with remote timing attacks.
From the document -- "... we can reliably distinguish remote timing differences as low as 20µs." So yes, you should be worried about the ...
- 1,489
31
votes
Accepted
Password hashing on frontend or backend?
@John already descriped the passing of the password over the network very well (use HTTPS).
To answer your question:
Where should I hash them? Frontend or Backend?
The backend. If you only hash ...
- 29.5k
27
votes
Accepted
Should I worry about remote timing attacks on string comparison?
In theory, this is a possible exploit, and if you are in super-paranoia mode, you should assume the answer being "Yes". In every other case, the answer will be: "No.".
Although there are published ...
- 5,201
25
votes
Accepted
What are the differences of checking a self-signed certificate vs ignore it?
If it's an official service you are integrating with the provider should really have a valid, publicly signed certificate installed for the sake of security.
Assuming that you need to continue on ...
- 3,782
24
votes
Accepted
How are code-branch side channel attacks mitigated on Java?
While you can make some attempt towards constant-time code in general purpose JITed languages like Java, you generally run into some problems:
The runtime implementation is, generally, intended to be ...
- 135k
21
votes
Timing attacks in password hash comparisons
The first algorithm is sensitive to timing attacks, while the second looks better (but I don't know for sure if it's vulnerable or not). However, there is a bug with potential security implications in ...
- 65.4k
20
votes
Accepted
What is the purpose/role of the "alias" attribute in Java keystore files?
ALIAS
To answer your immediate question, the alias field should be a unique string to identify the key entry. This applies to all types such a trusted and intermediate.
Documentation
Keytool
...
- 3,820
19
votes
Accepted
SSL Newbie : Does HTTPS client also need a certificate?
Depends what you are doing, and what you want to verify. If you are accessing data, and want to be sure that the server which knows the corresponding private key is the one sending you data (e.g. you'...
- 27.4k
18
votes
Password hashing on frontend or backend?
You are confusing two things: transport security and database security.
HTTPS using TLS only protects the transportation of the data from the client to the server. This means an eavesdropper does not ...
- 1,017
16
votes
What are the differences of checking a self-signed certificate vs ignore it?
By importing a known good self-signed certificate where the private key is unique and not compromised, the connection is just as safe as a full global CA PKI signed certificate. Those are after all ...
- 820
16
votes
Am I protected from Log4j vulnerability if I run Java 8u121 or newer?
https://research.kudelskisecurity.com/2021/12/10/log4shell-critical-severity-apache-log4j-remote-code-execution-being-actively-exploited-cve-2021-44228/
No, you're not safe. Currently we have to ...
- 337
14
votes
Should I worry about remote timing attacks on string comparison?
Store a good cryptographic hash of the secret on the server (i.e. treat it like a password). Your comparison then would be to take the hash of the string the client sends you, and compare the hashes.
...
- 4,007
14
votes
Accepted
Why do I need to add intermediate CA certificates to JVM's cacerts file?
The problem you describe happens usually if the server only sends its leaf certificate and does not add all the chain certificates needed to build the trust chain to the root CA. Unfortunately this is ...
- 198k
13
votes
Accepted
ECDSA: Why do ssh-keygen and Java generated public keys have different sizes?
Sizes are different because the formats are different. The strings you show are both binary values encoded in Base64. In all this message I talk about the binary values, i.e. I suppose that you first ...
- 325k
12
votes
Preventing Server-Side Request Forgeries in Java
This is the code I'm currently using:
if(!url.getProtocol().startsWith("http"))
throw new Exception();
InetAddress inetAddress = InetAddress.getByName(url.getHost());
if(inetAddress....
- 33.4k
11
votes
Why do I need to add intermediate CA certificates to JVM's cacerts file?
The Oracle JRE can automatically download the intermediate certificate:
Support for the Authority Information Access (AIA) Extension
Support
for the caIssuers access method of the Authority ...
11
votes
Poor error handling source code review
How are these related to security? According to my understanding it
seems like the above issues are code quality issues.
These are code quality issues. From the name, it looks like they are ...
- 3,901
11
votes
Timing attacks in password hash comparisons
You're both right, but you've both missed the point :)
You are correct: this is a classic example of a timing weakness and creates a possible side channel attack.
Your coder is correct: given network ...
- 31k
10
votes
SSL Newbie : Does HTTPS client also need a certificate?
Generally, most web servers running HTTPS do not require the client to have a certificate. If the server requires the client to authenticate, this is often done through credentials (e.g. username and ...
- 22.7k
10
votes
What is the best practice to store private key, salt and initialization vector in database?
I will answer your question in two parts since you asked it in two parts:
Question 1:
Is it secure to store salt and vector in database same table with private key? Currently I encode public and ...
- 2,721
9
votes
Accepted
Does Oracle's GuardedString protect sensitive data against heap or memory dumps?
Some deeper look into the actual implementation will help an attacker understand the data structure of a memory dump, and from what I found in EncryptorImpl there has been put no effort into ...
- 330
9
votes
Java UUID.randomUUID() or SecureRandom for id segment on URL?
In terms of the raw amount of random bits, yes.
Looking at the source for Java's random UUID generation, you can see they actually utilize the SecureRandom class to generate the raw bytes. So, the '...
- 458
8
votes
Accepted
Penetrate Testing Java Web Applications
You should get a professional to perform the test.
I however get the feeling that this not an option for you - so communicate to the person who hired you what you can do:
You can use Static ...
- 394
8
votes
Accepted
Questions about TLS handshaking process
A server generally isn't configured to only support one version. The server can be configured to accept all versions, even lower stuff like SSLv3. During the initial connection between the client and ...
- 12.7k
8
votes
Client-side BCrypt, store salt and hash separately in MySQL database
If you are not using a secured connection (https) then your schema is flawed in several ways:
The hashed password is all that is needed to log in: you are vulnerable to a replay attack;
Since the ...
- 7,622
8
votes
Accepted
Is it possible to exploit this Zookeeper instance?
First of all, I'm also not familiar with Zookeeper at all but I could give you some general advice from a security perspective.
The Zookeeper commands you listed sounds like administrative functions, ...
- 6,661
Only top scored, non community-wiki answers of a minimum length are eligible