I am looking for way to store some data. I want to users of my program to be able to choose a way to store data. They can choose database (PostgreSQL, MySQL) and I want to give opportunity to choose easier way for newbie users so they don't have to install database system. When they start my program for the first time they're passing user data (login/password) and the some data made by my program are stored on HDD of user. Is it any library (for Java) or something like db but configured automatically when that let me do this? I mean, I want to create some tables like in db and have an easy access to them. But they should be secured (access only with login/password passed at the first time). I hope you will understand me. It was difficult to explain what I want :)
You could use an embedded DB, like Apache Derby. See also the Working with encryption article.
If i'm understood right you need embedded SQL DB engine that can store data encripted? Take look at h2 databse
it's lightweight and has this
Security Features
Includes a solution for the SQL injection problem
User password authentication uses SHA-256 and salt
For server mode connections, user passwords are never transmitted in plain text over the network (even when using insecure connections; this only applies to the TCP server and not to the H2 Console however; it also doesn't apply if you set the password in the database URL)
All database files (including script files that can be used to backup data) can be encrypted using AES-128 and XTEA encryption algorithms
The remote JDBC driver supports TCP/IP connections over SSL/TLS
The built-in web server supports connections over SSL/TLS
Passwords can be sent to the database using char arrays instead of Strings
Related
I have always used a database located in my pc, so the steps to connect to it are:
connect to my local db using jdbc
perform queries
show results
now, i want to know what are the steps if the database is located in an online server?
some guides,tutorials are very appreciated.
Since you will be connecting to a remote database I would advise you to read about secure connections using JDBC. See this question, for example. You don't want to interact with a remote database without something like SSL to protect the confidentiality of the data.
Once you think you have secured your connection, you can use a tool like Wireshark to make sure that the packets that are going to and coming from your database are in fact opaque.
Furthermore, as others have said, not much changes if you already have a working connection to a local database, it's a matter of changing your URL from jdbc:mysql://localhost:port/database to jdbc:mysql://ipaddress:port/database.
From my experience, I found that some hosting companies block database access from unknown IP addresses, so it's possible that you'll have to go to your CPanel and whitelist your IP address.
Once your database connection is setup, the code you use to query the database should look the same.
Some useful links:
JDBC Best practices
JDBC Tutorials from Oracle
You have to change database url only to be like
jdbc:mysql://IP:3306/databasename
also username and password.
some hosting company like godaddy create database in localhost(in the same host) which doesn't need to change anything in your code.
I want to develop a thick client app (instead of using jsp/server side) which I will provide a login panel upon launching of my app. I am not sure whether it is the correct approach (in terms of security) so would like some comments.
Authentication will be through a back end database. That is, I create the user at the database level and my thick client app will authenticate with database using the provided user id and password. Is this method safe enough? or do I need a real session/password management api to do this?
How do I keep sessions in a thick client app like this? Also, if I want to encryption traffic between my app and the database server, should i just use JSSE or similar? Is there a way to encrypt data instead of the communication channel? I believe my database server need to also be able to decrypt my encrypted data.
I create the user at the database level and my thick client app will authenticate with database using the provided user id and password. Is this method safe enough?
Yes, provided you do as follows:
Hash the password in the database, rather than encrypt it.
Validate the user by querying the database SELECT count(*) FROM USERS WHERE USERNAME=? AND PASSWORD=MD5(?) or whatever hash algorithm you use. Note that this technique deliberately doesn't tell you whether the username or the password was wrong, so as to avoid any possibility of leaking that information to an attacker. The idea is that it returns either 1 or 0.
or do I need a real session/password management api to do this?
Not really.
How do I keep sessions in a thick client app like this?
If you mean a session that persists between logins, keep it in the database. If you just mean a session that lasts between login and logout, just keep it in an object that is released on logout.
Also, if I want to encryption traffic between my app and the database server, should i just use JSSE or similar?
Yes.
Is there a way to encrypt data instead of the communication channel?
The database can do it with encryption functions.
I believe my database server need to also be able to decrypt my encrypted data?
What encrypted data? If you mean the stuff transmitted over SSL, it will be decrypted automatically.
I have a java application that connects to an external sql database using jdbc 4. It uses prepared statements to select data from the database and also to send updates. Can the data that's transferred between the database and my application be classified as encrypted or are there further steps I would need to take in my application for it to be encrypted?
No, PreparedStatement does not equate to encryption. You would need to enable (better yet if you can require it; my familiarity is with postgresql rather than mysql) SSL on the server and set up a certificate and private key. You would then need to instruct your application to use SSL and to accept (only) the certificate belonging to the server.
Note that SSL and encryption in transit, while useful, does not protect the data from an attacker who gains access to the database.
PS. Most likely ServerFault would be the best resource for answers regarding how to configure mysql.
Edit for follow on: According to the documentation the credentials in the initial connection are secured.
A little bit of background --
I run a game server that runs in Java, and a forum that runs in PHP (phpbb). I have the game and forum accounts linked, such that changing the password in the game automatically changes the password for the forum account. The two systems use different password hashing algorithms, and I need to update the password hash on the forum side by using phpbb's built-in functions, meaning I have to call them from a PHP script (rather than running my own code).
In order to do this, I decided to have Java call the PHP script by making an HTTP request to the PHP script whenever the password needs to be changed, to trigger a PHP script that completes the password-changing process for the forum account. However, I don't want to put the plaintext password in any HTTP call, since it might show up in log files and maybe other exploitable areas. My current idea is that when the Java side is changing passwords, it puts the new plaintext password in a database table, and then makes an HTTP request to trigger the PHP script, such that no hashes or sensitive information goes into the HTTP request. The HTTP call would only pass the username of the account to be changed, and a md5 hash of a shared secret plus the username, for authentication. When the PHP script runs, it retrieves the new plaintext password for the user from the database, immediately deletes it, then runs the plaintext password through phpbb's hashing algorithm and updates the forum database.
Under typical conditions, the plaintext password would probably be in the database for less than a second before it is deleted. Ideally, I wouldn't be storing it anywhere at all, but I am not sure how else to communicate the needed change from Java to PHP when I can't predict what the forum's password hash will be, so I need to somehow send the plaintext password to the PHP script that does the hashing.
Any ideas on a better way to do this, or is there any feedback on storing the plaintext password for a very short period of time? I consider the MySQL login to be secure and is not shared with other people or projects.
Thanks!
Don't store plaintext passwords.
If your game becomes popular, it might be a target to constant attacks of hackers
especially if it will contain a monetary aspect (i.e - the case of world of warcraft, travian and others).
In this case, you will need to assume that although you attempt to protect your system,
Someone might hack it, and as a result get sensitive data.
You should use standard encryption mechanisms in order to perform this task (i.e - send the password to forum system via HTTPS for example, in a secure way).
I would also recommend you to explore the comment of #Joshua Kaiser - single sign on may be the key to answer your needs,
and don't try to reinvent the wheel here. I can tell you I Work with kerberos for example,
and Kerberos has a ticket mechanism in which the tickets can be re-used among applications. Unfortunately I dont know PHP, and don't know how pluggable the forum framework to use different authentication modules.
P.S - I posted this answer twice by mistake, and tried pressing "delete post" - I hope stackoerflow takes care of that.
Encryption is the way.
Encrypted connection: Synonym for HTTPS. Pass the data to phpbb using HTTPS, if your server supports it.
Encrypted data: either encrypt the password and somehow store the key (very insecure), or use asymmetric encryption. See the answer to my question for a good insight of how to send the password over a secure channel.
It depends on the database that you're using with Java more than PHP. In PHP use PDO to connect to the different database and manipulate the data. You might try simply having one DB as the primary password storage and the other as salve - depending on reverse encryption mind you.
Have PHP (For example) PDO the text password directly into the Java db in a temp field - specific to the user of course - and then tell PHP to trigger a Java Function to read that column, hash it, update the correct column and delete the temp field.
If done properly, you could have the time-frame of vulnerability limited to a few milliseconds.
I need a secure way to send information from a Java application to a database for my website. I currently have a PHP page on the server that accepts the parameters posted from a URLConnection in Java, and then updates the database. My fear is that, if somebody decompiles it, they can see the exact URL and parameters. I am new to this type of development, so I don't know a better/safer way to do it.
What is a better or safer way to get the data to the database?
If you want to give the application access to the database then you can never 100% prevent any application simulating the behaviour of your application from having the same access. period. You can only make your pattern harder to be found.
Better is letting your server (in this case your php-document) validate each and every input it gets so that bad behaviour is excluded. Let the php generate querys and let the client-application only send the data needed like username, password or other information. in your php, you have to be prepared, that everything could be send, not only data you expect. Use prepared statements to prevent sql-injections and use regex to sanitise any input given.
If I understood well, you're afraid that someone will find out from your code url, username and password and connect to the database with these parameters. You can prevent that misbehaviour on network layer (i.e. allowing only your IP address to access the database by configuring firewall) or, if you cannot alter firewall/router configuration then change the database configuration. For example, PostgreSQL has a file pg_hba.conf where you can specify list of IP addresses that are allowed to access. However, you must prevent other vulnerabilites like SQL injection that use your connection to the database.
From the sounds it, your using a Java program to connect to your PHP/server. If your worried about the security of the connection, you could establish a SSL connection using HTTPS (example here)
You could also establish a challenge/response protocol, where the server requests some kind of key from the client, this could use a rolling series of public/private keys with the message encrypted with these to further reduce the chance of a false input request