Java’s SSLSocket How Bad APIs Compromise Security

calendar Mar 20, 2015 · 2 min read · java api security ssl sslsocket  ·
Share on: linkedin copy

Java’s SSLSocket How Bad APIs Compromise Security

Georg Lukas

published in Magdeburger Journal zur Sicherheitsforschung (2015, #9, p. 506-513)

Info

Internet security is hard. TLS is almost impossible. Implementing TLS correctly in Java is »Nightmare!«. This paper will show how a badly designed security API introduced over 15 years ago, combined with misleading documentation and developers unaware of security challenges, causes modern smartphone applications to be left exposed to Man-in-the-Middle attacks. This article appears in the special edition „In Depth Security – Proceedings of the DeepSec Conferences“. Edited by Stefan Schumacher and René Pfeiffer

Downloads

BibTeX-Entry für mjs:Lukas:Java 

 1@article{mjs:Lukas:Java,
 2  author = {Georg Lukas},
 3  title = {Java’s SSLSocket},
 4  subtitle = {How Bad APIs Compromise Security},
 5  pages = {506-513},
 6  year = {2015},
 7  journaltitle = {Magdeburger Journal zur Sicherheitsforschung},
 8  issn = {2192-4260},
 9  url = {https://d-nb.info/1074038169/34},
10  codeberg = {https://codeberg.org/0xKaishakunin/Publikationen/src/branch/main/MagdeburgerJournalSicherheitsforschung/MJS_034_Lukas_Java.pdf},
11  issue = {1},
12  volume = {9},
13  urldate = {2015-03-20},
14  keywords = {mjsarticle,ds15,java,api,security,ssl,sslsocket},
15  abstract = {Internet security is hard. TLS is almost impossible. Implementing TLS correctly in Java is »Nightmare!«. This paper will show how a badly designed security API introduced over 15 years ago, combined with misleading documentation and developers unaware of security challenges, causes modern smartphone applications to be left exposed to Man-in-the-Middle attacks. This article appears in the special edition „In Depth Security – Proceedings of the DeepSec Conferences“. Edited by Stefan Schumacher and René Pfeiffer},
16}

AsciiDoc citation commands 

1. citenp:[mjs:Lukas:Java]
2. cite:[mjs:Lukas:Java]
3. bibitem[mjs:Lukas:Java]

LaTeX citation commands 

1. \textcite{mjs:Lukas:Java}
2. \parencite{mjs:Lukas:Java}
3. \cite{mjs:Lukas:Java}

generated at Mon May 12 10:48:34 2025