Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsWhite Papers
Discussion GroupsFirst AidDatabasesJavaBeansGUIJava 3DVirtual MachineCORBASecurityToolsGeneral
Java DirectoryOpen Source ProjectsSample Book ChaptersUser GroupsWeb Resources
Related Topics
Databases.NETMore Topics ...

Java Forum / Security / November 2003

Tip: Looking for answers? Try searching our database.

security question

Thread view: 
Vissu - 03 Nov 2003 01:19 GMT
Hi,

We use Applet->Servlet request/response streams to send sensitive
information about our sales.  We are using SSL for network encryption.
Is there anyway someone could see the sensitive information anywhere
once the data leaves applet VM and before it enters servlet VM?

Thanks

Viss
Roedy Green - 03 Nov 2003 02:31 GMT
>Is there anyway someone could see the sensitive information anywhere
>once the data leaves applet VM and before it enters servlet VM?

no.  Though, Bush could if ordered the CIA to snoop.  An attack would
more likely involve replacing code for the Applet or server or just
crack the server and go snooping around.

--
Canadian Mind Products, Roedy Green.
Coaching, problem solving, economical contract programming.
See http://mindprod.com/jgloss/jgloss.html for The Java Glossary.
VK - 03 Nov 2003 23:15 GMT
Depends on who you are trying to protect yourself from.
There are only two points where the Internet traffic can be intercepted
for sure: sending server and receiving server.
Between these two points the IP packages go by the rule of the
"optimized fluctuation" (or Monte Carlo law - don't kill me for the
terms, it's my personal translation to English). It means that despite
there always is the main path (this is how ping and tracert programs
work), 0.0*x - x % of packages can come to the receiving server from
totally different directions.
So in order to trace the whole traffic between point A and B, you have
to either be in A or B, or you have to connect a super mainframe to a
physical narrowness of the Net (Atlantic cable, Canada/USA T1 etc). The
last option is for the "Bugs" TV series, not for the real life, so you
may feel yourself pretty secure from this side :-)
About A and B control it is as being said: unless the government decides
to use the Carnivore program on you (are you in the USA?) or unless you
provider is a nasty crook, the 1024bit certificate is the plenty good
maximum of what you can do now to protect your data.

P.S. 3rd (updated) Parkinson-Merfy law: everything created by one human
being can be disassembled and/or changed by another human being.


Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.