Java security: from HotJava to netscape and beyond

Drew Dean; Edward William Felten; Dan S. Wallach

Java security: from HotJava to netscape and beyond

Drew Dean, Edward William Felten, Dan S. Wallach

Princeton University

Research output: Contribution to journal › Article › peer-review

122 Scopus citations

Abstract

The introduction of Java applets has taken the World Wide Web by storm. Information servers can customize the presentation of their content with server-supplied code which executes inside the Web browser. We examine the Java language and both the HotJava and Netscape browsers which support it, and find a significant number of flaws which compromise their security. These flaws arise for several reasons, including implementation errors, unintended interactions between browser features, differences between the Java language and bytecode semantics, and weaknesses in the design of the language and the cytecode format. On a deeper level, these flaws arise because of weaknesses in the design methodology used in creating Java and the browsers. In addition to the flaws, we discuss the underlying tension between the openness desired by Web application writers and the security needs of their users, and we suggest how both might be accommodated.

Original language	American English
Pages (from-to)	190-200
Number of pages	11
Journal	Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy
State	Published - Jan 1 1996

ASJC Scopus subject areas

Software

Cite this

@article{457e5f10da3949218f3d8e86d3761b26,

title = "Java security: from HotJava to netscape and beyond",

abstract = "The introduction of Java applets has taken the World Wide Web by storm. Information servers can customize the presentation of their content with server-supplied code which executes inside the Web browser. We examine the Java language and both the HotJava and Netscape browsers which support it, and find a significant number of flaws which compromise their security. These flaws arise for several reasons, including implementation errors, unintended interactions between browser features, differences between the Java language and bytecode semantics, and weaknesses in the design of the language and the cytecode format. On a deeper level, these flaws arise because of weaknesses in the design methodology used in creating Java and the browsers. In addition to the flaws, we discuss the underlying tension between the openness desired by Web application writers and the security needs of their users, and we suggest how both might be accommodated.",

author = "Drew Dean and Felten, {Edward William} and Wallach, {Dan S.}",

year = "1996",

month = jan,

day = "1",

language = "American English",

pages = "190--200",

journal = "Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy",

issn = "1063-7109",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

}

TY - JOUR

T1 - Java security

T2 - from HotJava to netscape and beyond

AU - Dean, Drew

AU - Felten, Edward William

AU - Wallach, Dan S.

PY - 1996/1/1

Y1 - 1996/1/1

N2 - The introduction of Java applets has taken the World Wide Web by storm. Information servers can customize the presentation of their content with server-supplied code which executes inside the Web browser. We examine the Java language and both the HotJava and Netscape browsers which support it, and find a significant number of flaws which compromise their security. These flaws arise for several reasons, including implementation errors, unintended interactions between browser features, differences between the Java language and bytecode semantics, and weaknesses in the design of the language and the cytecode format. On a deeper level, these flaws arise because of weaknesses in the design methodology used in creating Java and the browsers. In addition to the flaws, we discuss the underlying tension between the openness desired by Web application writers and the security needs of their users, and we suggest how both might be accommodated.

AB - The introduction of Java applets has taken the World Wide Web by storm. Information servers can customize the presentation of their content with server-supplied code which executes inside the Web browser. We examine the Java language and both the HotJava and Netscape browsers which support it, and find a significant number of flaws which compromise their security. These flaws arise for several reasons, including implementation errors, unintended interactions between browser features, differences between the Java language and bytecode semantics, and weaknesses in the design of the language and the cytecode format. On a deeper level, these flaws arise because of weaknesses in the design methodology used in creating Java and the browsers. In addition to the flaws, we discuss the underlying tension between the openness desired by Web application writers and the security needs of their users, and we suggest how both might be accommodated.

UR - http://www.scopus.com/inward/record.url?scp=0029697575&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=0029697575&partnerID=8YFLogxK

M3 - Article

SN - 1063-7109

SP - 190

EP - 200

JO - Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy

JF - Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy

ER -

Java security: from HotJava to netscape and beyond

Abstract

ASJC Scopus subject areas

Other files and links

Fingerprint

Cite this