0
votes
0answers
15 views

Best approach for storing banking information [migrated]

I am currently developing an auction desktop application. At the moment I am storing the buyer and vendor information in 2 separate tables within a MySQL Database. Currently the data for these tables ...
0
votes
0answers
36 views

Access Token Verification

I have spent quite a few days reading up on Oauth and token based security measures for REST API's and I am currently looking at implementing an Oauth based authentication approach almost exactly like ...
0
votes
1answer
101 views

Do we have any special design considerations for maintaining anonymity in an application?

This is an open-ended question which I am analysing while doing some fun projects in leisure. Websites like Google, Facebook do store user activities and perhaps sell them or use them for ...
23
votes
6answers
2k views

How is major software protected? [duplicate]

I am a new software developer and I wish to sell my software. I recently realized that from C++ code we can not stop the user seeing parts of the code that are related to scripts or system commands. ...
2
votes
1answer
237 views

How to audit an Android application (not rooted) without having access to its source?

How can I check if an Android application running on a not rooted device is "secure" without knowing its source? I would look for: Plain text in Web-Requests (wireshark and emulator) SQL-injection ...
1
vote
3answers
382 views

Avoid malicious code while dynamically loading classes with ClassLoader

Background One of the advantages of decoupled components in systems is that you can extend the system without having to touch the existing code. Sometimes you don't even have to recompile the old ...
6
votes
3answers
230 views

How will writing the transaction part in Java benefit the security of the application, when all other parts are being written in PHP?

A friend of mine while working on a PHP application asked me to write one part of the application in Java. The part that involved transactions. He said it will be better to write this portion in Java. ...
-1
votes
1answer
533 views

Appropriate selection of security framework [closed]

I have a web application to be developed using RESTeasy API and for this I have to implement security (Form based authentication). So i am not sure about the most appropriate fit for this. As I ...
1
vote
1answer
638 views

Is the escaping provided by the Google-Gson library enough to ensure a safe JSON payload?

I am currently using the Google-Gson library to convert Java objects into JSON inside a web service. Once the object has been converted to JSON, it is returned to the client to be converted into a ...
9
votes
2answers
781 views

How do CDNs protect failover sites from DDoS attacks?

I'm in the design process for a Java web app that I will probably end up deploying to Google App Engine (GAE). The nice thing about GAE is that I really don't have to worry about fortifying my app ...
8
votes
3answers
532 views

Is it a security flaw to log the class and method name when an exception occurs?

I have the following : public class doCheck(){ public void performCheck(){ try { perform all checks...... } catch(Exception e){ ...
3
votes
1answer
116 views

What procedures or audits should be used to assess the security of a software system?

Are there any standardised security procedures or auditing techniques that can be used to assess the security of a piece of software? I'm specifically interested in auditing software written in Java, ...
11
votes
6answers
2k views

What would truly happen if java.lang.String weren't final?

I'm a long time Java developer and finally, after majoring, I have time to study it decently in order to take the certification exam... One thing that has always bothered me is String being "final". I ...
5
votes
3answers
1k views

Is blocking java applets a necessary security measure?

Chrome 11 is now asking user permission to run both signed and unsigned Applets (yes, for signed applets the user is asked twice). Chromium team decided that this measure is needed even when the user ...