RE: secure storage of sensitive data in J2EE

[Michael Silk <michaelsilk () gmail com>]

Comments inline.

> -----Original Message-----
> From: exon [mailto:exon () home se] 
> Sent: Friday, 11 February 2005 9:33 AM
> To: webappsec () securityfocus com
> Subject: Re: secure storage of sensitive data in J2EE
>
> Michael Silk wrote:
> > Exon said:
> >
> > > Because it's supposed to be encrypted when it arrives over the 
> > > network.
> >
> >
> > And how can that happen in such a way that an application 
> listening to 
> > the incoming information can't get at it first?
>
> It can't, but protecting pieces of memory from prying eyes 
> was what this discussion was about. 

Yes, and the sub-discussion with Michael Howard was about the
usefulness of SecureString (this is the discussion where you responded
to me).

-- Michael