Re: Cracking String Encryption in Java Obfuscated Bytecode

Hi,

1) If you are deploying Java on the server you are protected by so many
layers, code obfuscation is not critical

If you want to distribute your app without people getting access to the
code itself, being on client or server is not relevant. Whatever the
reason for wanting to do so.

2) If you are deploying Java Applets for enterprise applications, you
are nuts. They are inherently insecure and Java applets have a long
history of critical problems.

So have cookies and javascript based web applications. Yet cookies are
used everywhere for anything/everything and "ajax" is the new big boy in
town. It is not because something is insecure that people don't use it in
the real world, not the perfect secure one.

You would be amazed of how many times I heard "it's useless to check again
the data on the [php|java|asp|perl] side, we already did it in JS" or "why
add a java middle-tier server side, we can obfuscate the jar file and have
the client PC talk directly to the database" (yeah sure, I'll make a
public, unencrypted, access for you guys).

From a security *threat* point of view, I agree that we could/should more
of these issues.

With the continuous move towards bytecode type of languages (with java
and .NET being the prime examples)
Same goes with PHP BTW.

JG

Relevant Pages

  • Re: Client-Side Session Data
    ... token on the client, but does it keep the session *data* on the ... How Not To Use Cookies ... Userdata belongs on the server, ... Session time out and cookies, ...
    (comp.lang.php)
  • Re: Is anything easier to do in java than in lisp?
    ... > handles cookies (and chosing which ones to send when and parsing the ... i've successfully used this client to build ... AllegroServe is a LLGPLed Web server which ...
    (comp.lang.lisp)
  • Re: If not readdir() then what?
    ... the existing set of cookies have expired and are no longer valid: ... which is supposed to be returned by the client on every call to READDIR. ... If the server wants to change its cookie scheme, ... the client by changing its verifier, and returning an error whenever the ...
    (Linux-Kernel)
  • Re: cookies lost in client broswer
    ... Cookies involve cooperation between the client, server, and intervening ... Server must send Set-Cookie header ...
    (microsoft.public.inetserver.iis.security)
  • Re: What doesnt lend itself to OO?
    ... >> proxy and instructs the server to constuct the real object. ... rather than client code. ... If 'clock' is instantiated in the server, ... > for the server interface at the OOA level. ...
    (comp.object)
Quantcast