0
votes
0answers
63 views

Access Token Verification

I have spent quite a few days reading up on Oauth and token based security measures for REST API's and I am currently looking at implementing an Oauth based authentication approach almost exactly like ...
0
votes
1answer
103 views

Do we have any special design considerations for maintaining anonymity in an application?

This is an open-ended question which I am analysing while doing some fun projects in leisure. Websites like Google, Facebook do store user activities and perhaps sell them or use them for ...
23
votes
6answers
2k views

How is major software protected? [duplicate]

I am a new software developer and I wish to sell my software. I recently realized that from C++ code we can not stop the user seeing parts of the code that are related to scripts or system commands. ...
2
votes
1answer
275 views

How to audit an Android application (not rooted) without having access to its source?

How can I check if an Android application running on a not rooted device is "secure" without knowing its source? I would look for: Plain text in Web-Requests (wireshark and emulator) SQL-injection ...
1
vote
3answers
424 views

Avoid malicious code while dynamically loading classes with ClassLoader

Background One of the advantages of decoupled components in systems is that you can extend the system without having to touch the existing code. Sometimes you don't even have to recompile the old ...
6
votes
3answers
235 views

How will writing the transaction part in Java benefit the security of the application, when all other parts are being written in PHP?

A friend of mine while working on a PHP application asked me to write one part of the application in Java. The part that involved transactions. He said it will be better to write this portion in Java. ...
-1
votes
1answer
554 views

Appropriate selection of security framework [closed]

I have a web application to be developed using RESTeasy API and for this I have to implement security (Form based authentication). So i am not sure about the most appropriate fit for this. As I ...
1
vote
1answer
731 views

Is the escaping provided by the Google-Gson library enough to ensure a safe JSON payload?

I am currently using the Google-Gson library to convert Java objects into JSON inside a web service. Once the object has been converted to JSON, it is returned to the client to be converted into a ...
9
votes
2answers
812 views

How do CDNs protect failover sites from DDoS attacks?

I'm in the design process for a Java web app that I will probably end up deploying to Google App Engine (GAE). The nice thing about GAE is that I really don't have to worry about fortifying my app ...
8
votes
3answers
552 views

Is it a security flaw to log the class and method name when an exception occurs?

I have the following : public class doCheck(){ public void performCheck(){ try { perform all checks...... } catch(Exception e){ ...
3
votes
1answer
116 views

What procedures or audits should be used to assess the security of a software system?

Are there any standardised security procedures or auditing techniques that can be used to assess the security of a piece of software? I'm specifically interested in auditing software written in Java, ...
12
votes
6answers
2k views

What would truly happen if java.lang.String weren't final?

I'm a long time Java developer and finally, after majoring, I have time to study it decently in order to take the certification exam... One thing that has always bothered me is String being "final". I ...
5
votes
3answers
1k views

Is blocking java applets a necessary security measure?

Chrome 11 is now asking user permission to run both signed and unsigned Applets (yes, for signed applets the user is asked twice). Chromium team decided that this measure is needed even when the user ...