Re: secure storage of sensitive data in J2EE

[exon <exon () home se>]

Michael Silk wrote:
> Comments inline.
>
>
> > -----Original Message-----
> > From: exon [mailto:exon () home se] 
> > Sent: Friday, 11 February 2005 9:33 AM
> > To: webappsec () securityfocus com
> > Subject: Re: secure storage of sensitive data in J2EE
> >
> > Michael Silk wrote:
> >
> > > Exon said:
> > >
> > >
> > > > Because it's supposed to be encrypted when it arrives over the 
> > > > network.
> > >
> > >
> > > And how can that happen in such a way that an application 
> >
> > listening to 
> >
> > > the incoming information can't get at it first?
> >
> > It can't, but protecting pieces of memory from prying eyes 
> > was what this discussion was about. 
>
>
> Yes, and the sub-discussion with Michael Howard was about the
> usefulness of SecureString (this is the discussion where you responded
> to me).

SecureString (whatever that is) would, if it works as the name suggests, 
be useful for keeping the key to decrypt the incoming packets. If data 
is to be sent in plaintext it's naturally of no use at all.

> -- Michael