Password choice for PBE

Hi everybody,
I'm writing a little webproject which is writing encrypted texts into a database using PBE (with Jasypt packages) and displaying it decrypted. I'm using "PBEWITHSHA256AND256BITAES-CBC-BC" (BouncyCastleProvider).
Everthing is working fine, but I have a question regarding the password which used to generate the key.
How can make sure that my password is complex enough to make real use of the 256bit AES?
The password is saved as cleartext in my javacode cause I' have to decrypt the texts as well.
The second questions is if it is common to "store" the password as cleartext in my WebApplication or are there other more secure ways to do it?
sorry for my bad english.
greetings philipp

Don't worry about your english, Philip; you're getting your meaning across :-).
David Hook - the creator of BouncyCastle - wrote in his book that you have to question the effectiveness of your encryption if you're using strong ciphers like 3DES or AES-256, but using weak passwords to protect the symmetric keys. His point - and every experienced security practitioners' - is that the overall security of a system is ultimately dependent on the weakest link in the chain. And in PBE, the typical weak link is the password and how you protect that password.
I would encourage you to do the following:
1) Write - or lookup - a password routine that requires strong passwords (a combination of alpha, numeric and special characters);
2) Not store the password in a file at all, but have the Servlet/J2EE container prompt for the password upon startup. If the business requirements will not allow for an SA to supply the password upon startup (because they want an automatic restart), then make it clear that the system has a residual vulnerability that can potentially be exploited by an attacker who compromises the machine.
You cannot have an automatic restart of an application with cryptography modules in it, and robust security at the same time. You have to protect that weak link in the chain using an external process or control. Businesses need to understand this. As long as security programmers and practitioners keep delivering code/systems that gives the impression of security without actually providing it, the bad guys always win.

Similar Messages

Password file for MQ - Encrypted

Hi,
I wish to use a passwordfile for my implementation of Java MQ, but do not want to have it stored in plain text.I use imqcmd as part of my deployment process and do no want to be prompted for passwords as it is automated.
Is there any way in which to encrypt the password file for imqcmd commands?
Thanks,
Anthonie

The source code for IMQ and J233 is available to download.
You can then customize the code to do whatever you want (i.e. read in a password in some encrypted format using an algorithm of your choice and then unencrypting it before passing it on).
You can easily do this for the KEYSTORE / TRUSTSTORE password files by writing your own Java security provider.
Here are the steps for that:
*1. Write a custom java security provider.*
public class YOUR_PROVIDER_Provider extends java.security.Provider
your code here ...
public class YOUR_PROVIDER_Provider extends Provider
public YOUR_PROVIDER_Provider()
super("YOUR_PROVIDER_Provider", 1.0, "A Custom Security provider");
String className = YOUR_PROVIDER_Provider.class.getName();
put("KeyStore.JKS", className);
2. then,
Need an entry in the java.security file like this:
security.provider.1=YOUR_PROVIDER_Provider
The above order MUST be 1 in order to override the Sun default security provider
* @see java.security java.security file located in: {$JRE_HOME}\lib\security\
*3. write your own JavaKeyStore* (you can download Sun's java source code to use as a baseline.
I would recommend using this one:
sun.security.provider.JavaKeyStore
If you change the package name to a custom one, you will need this (due to "package protect" accessor of this class)
sun.security.provider.KeyProtector
In this class:
sun.security.provider.JavaKeyStore
Modify these methods:
public Key engineGetKey(String alias, char[] password)
throws NoSuchAlgorithmException, UnrecoverableKeyException{
// ... your code
public void engineSetKeyEntry(String alias, Key key, char[] password,
Certificate[] chain)
throws KeyStoreException{
// ... your code
public void engineStore(OutputStream stream, char[] password)
throws IOException, NoSuchAlgorithmException, CertificateException
// ... your code
public void engineLoad(InputStream stream, char[] password)
throws IOException, NoSuchAlgorithmException, CertificateException
// ... your code
4. put your custom files inside a .jar file and put this in the java classpath AHEAD of the standard java ones:
e.g.
java -Xbootclasspath/p:YOUR_JAR.jar
you will have to do this inside the IMQ startup script
alternatively you can simply edit the imqbrokerd.conf file to something like this:
ARGS=-vmargs -Xbootclasspath/p:YOUR_JAR.jar:
this file is in: IMQ_HOME/etc/mq/

Adobe Creative Cloud and Adobe Creative Suite: New Choices for Customers

Adobe has announced the new Cloud-based model for software distribution, along with new terms for boxed product upgrade eligibility. Beginning with the CS6 releases, when they happen, upgrade pricing on boxed products will only be availble one generation back. There is a limited window to upgrade now to the current versions at a discount.
See http://blogs.adobe.com/conversations/2011/11/adobe-creative-cloud-and-adobe-creative-suite -new-choices-for-customers.html

Eugene:
Based on the current information we have (from the blog post), which may not be correct and which you should not rely upon:
There is some confusion about the word "discount." As used in the blog post, in general there are no "discounts" for upgrades, there is the upgrade price and there is full price. But, also in the blog post, there is a special "discount upgrade" if you choose to upgrade to CS5.5 today (prior to Dec. 31, 2011), which is 20% off the regular upgrade. However, Peter used the word "discount" to distinguish between upgrade pricing and full price. It's probably a good idea to avoid using that word there because of the potential for confusion.
I have CS5 InDesign in work. So I will be able to upgrade that to CS6 when it comes out at the discount price?
You will be able to upgrade to CS6 at upgrade pricing. Not the 20% discount, but it is "discounted" from the full price of CS6.
I'm still using CS2 Illustrator and Photoshop, for the little work I do in those programs, they're fine. But if I want to upgrade them to CS6 I have to pay the full amount of an upgrade, with no discount... or will I have to pay for CS6 in full for both of these programs?
You will have to pay the full price (not the "full amount of an upgrade," whatever that means).
If you elect to upgrade to CS5.5 prior to Dec. 31 of this year, however, then then you can pay the discounted upgrade price to upgrade to CS5.5 (well, CS5 since Photoshop CS5.5 doesn't exist), and then you can pay the CS6 upgrade price in March/April. So you can pay for no upgrades (full price) or two upgrades (one of which is 20% off).
At the moment I can upgrade CS2, photoshop and Illustrator for €240 each, to CS5. So wouldn't I just be able to do that now and then buy the CS6 upgrade at a much later date perhaps just before CS7 comes out?
Yes, you can do that.
If CS6 has the tools to basically go "File>Export>Epub" and I get a fully working epub file without having to trash about in code afterwards or make complex tagging in InDesign, then I'll be buying it.
It looks like EPUB is evolving pretty fast, so even if ID CS6 fully supports what you want out of EPUB on Day 1, I bet you'll need to be prepared to postprocess it on Day 2. Or at least long before Day 200.

I have an Ipad My apple ID and password works for Ibooks and Icloud but when I try to get into the app store it doesn't show my entire email address on the account. When I try to get into the app store it tells me my password is incorrect. How can I corr

I have an Ipad My apple ID and password works for Ibooks and Icloud but when I try to get into the app store it doesn't show my entire email address on the account. When I try to get into the app store it tells me my password is incorrect. How can I correct this? I have been emailing support but so far they have been no help

Open the App Store app, go to the Featured pane, swipe to the bottom, tap the Apple ID and sign out. Tap again and sign in with the Apple ID of your choosing.

Different Password Policy for Different User Groups in ACS 4.2

Hi All,
Can some one provide a solution for the below requirement?
We do have ACS 4.2 appliance managing firewalls of different clients. The users are common i.e, helpdesk administrators. One of the client came up with setting different password policy for managing their devices i.e, the client wants to have min 15 characters as password length. We do have currently 8 characters as min password length. Can we change the password policy to min 15 characters only for managing the firewalls of this client whereas for all other client firewalls we feel better to have 8 characters as min password length?
It seems that these password policies are global & affects all the users.
This is something like, having two sets of password (for each user) policy depending on the client which he is going to manage.
For my knowledge, i think that this is not possible. But, thought to cross-check with experts!
-Jags.

Hi jags,
Yor're correct. Password policy on ACS will affect all internal user. We can't create different password policies for diferent clients/connections/set_of_users
Password validation options apply only to user passwords that are stored in the ACS internal database. They do not apply to passwords in user records in external user databases; nor do they apply to enable or admin passwords for Cisco IOS network devices.
HTH
Regards,
JK

How do I stop firefox from keeping my email and password online for facebook?

how do I stop firefox from keeping my email and password online for facebook?
== This happened ==
Every time Firefox opened
== in the past week

If you are not on Windows then see [http://kb.mozillazine.org/Menu_differences]
See [[Options window - Security panel]]
See also:
* http://kb.mozillazine.org/Deleting_autocomplete_entries
* http://kb.mozillazine.org/Password_Manager

How To create a message Choice for a page?

Hi,
I need to create a message choice for a page and on selection of that it should navigate me to next page..like
ex:
If iam havng 10 locations like Delhi,Hyderabad,Chennai....
I need to select one of them and it should be navigated to next page based on the above selection...These values are to be retrieved from database...
Can u gimme any idea..how to proceed?

Maybe something like this will help.
On your <af:selectOneChoice/> component configure a valueChangeListener and set autosubmit to true.
In your valueChangeListener change the current view like :
public void handleValueChanged(ValueChangeEvent valueChangeEvent) {
// Add event code here...
if (!PhaseId.INVOKE_APPLICATION.equals(valueChangeEvent.getPhaseId())) {
valueChangeEvent.setPhaseId(PhaseId.INVOKE_APPLICATION);
valueChangeEvent.queue();
} else {
// add additiional app functionality here
ControllerContext controllerContext = ControllerContext.getInstance();
ViewPortContext viewPortContext = controllerContext.getCurrentViewPort();
viewPortContext.setViewId("test");
Regards,
Kenneth
The deferred execution of ValueChangeEvent is necessary as the ViewID can only be changed in INVOKE_APPLICATION phase.

My apple ID password works for all of my devices but one. i only have one account and have changed the password several times but still cannot get it to work on my iPhone. any suggestions would be appreciated.

My apple ID password works for all of my devices but one. i only have one account and have changed the password several times but still cannot get it to work on my iPhone. any suggestions would be appreciated.

Thanks for the suggestion, Chris. I actually did not resolve the issue which is why i did not post an answer.
it turns out that my iphone seems to default to an incorrect User ID (it defaults to an @me account, which is not something that i have ever used).
even when i change the User ID in my settings for the iTunes store, it still appears when i attempt to get updates for my existing apps. however, it does seem to use the correct ID when i attempt to purchase new apps.
If someone actually had an answer to correct this, i would love to update my existing apps.
Thank you.

HT5622 I think my granddaughter bought a $3.99 app after I put the password in for a free app. How can I find out what she purchased? Can I get credit for it? I just got an email from my credit card confirming the purchase.

I think my granddaughter bought a $3.99 app after I put the password in for a free app. I just got an email from my credit card confirming the purchase. How can I find out what she purchased? Can I get credit for it?

The password is good for 15 minutes to make purchases. You should receive a receipt in 24 to 48 hours for the purchases. There is a link to Report an issue. You could use that to start a conversation with iTunes Support about a refund.
Apple considers all sales final. But has been known to offer a one time refund. So the question is, do you want to use your one time refund on this purchase or one more expensive in the future?

Officejet Pro 8600 Premium e-All-in-One - N911n photo paper Not a paper choice for Tray 1

For the HP Officejet Pro 8600 Premium e-All-in-One - N911n printer
I am running Windows 7 64-bit
No error Messages
New Printer setup
I do not see photo paper as a paper choice for in Tray 1
This question was solved.
View Solution.

Hi FrancoArdito,
Follow the steps below to print photo from Tray 1
1. Insert the 4x6, 5x7 or 8x10 photo paper into Tray 1
2. Open printer preferences from the printing application program
3. Click on Paper/Quality tab
4. Select the Paper Size, Media Type, and the the Paper source
5. Click Ok to save the settings, and then print from the application program.
I am an HP employee.
Say Thanks by clicking the Kudos Star in the post that helped you.
Please mark the post that solves your problem as "Accepted Solution"

Choices for free goods determination

Hi all,
I want to have choices for free goods determination, like for Material A I want an option to select either of Material A or B.
Is this possible.
regards,
Vandana Arora

hello, friend.
it is possible to do this manually, and not through the free goods determination.
let us say you want to give 1 unit of either material A or B for every 10 units of C ordered by the customer. what you do is create a sales order for 10 units of C as the first line item. let us further say the first line item is item 10.
enter either A or B as the second line item, which is item 20. go to the column HL Itm and enter 10. also change the item category of this line item to TANN. just be sure to maintain this set up in item category assignment in IMG.
there are drawbacks to this procedure, in that your choices for free goods will not be limited to material A or B. but this could work for you.
you may also wish to create a BOM, wherein free good A can be replaced by B.
regards.

What are the 3-bit field choices for Hw_Arm_Sel in PCI-6601

Hi,
I am programming our own driver to operate the PCI-6601. For our application we need hardware arm option. I know it is possible to use 2 counters for that, but NI-TIO should support also hw_arm. Although it is not explained in the registry document at all, after some tedious check in the DDK examples I found that this bits are located in the Gi counting mode register. I know the position of the HW_enable as well as the position of the 3 bits for pin sellect options. What I do not know is What are the 3-bit field choices for Hw_Arm_Sel . I contacted NI support but got no support. How can NI sell boards and when a customer who is not using LAbview or Measurement Studio or DDK, but is implementing his own driver is then so arrogantly turned down from NI? Also, how can NI publish just part of the registers the board support, and when a customer contacs and asks for some registers get not at all support? I can not foretell the missing registers, and it is pretty unprofessional to document just partly the registers of 660x devices. And on request you got nothing.
I hope someone from the community know about this Hw_Arm_Sel 3 pin options. Otherwise, there is just an option of error and trial. Or simply throw the board in the garbage.
Dr. Kirco Arsov
Solved!
Go to Solution.

Hi Kirco,
I have some more information for you :-)
I haven't been able to speak to the developer who is the most familiar with TIO programming since he's out of the office, but I have come across his notes from when he was writing support for the DAQmx driver.
As I described earlier, the HW_Arm_Sel bits don't select a connector I/O pin, but an internal trigger signal. There are seven internal trigger lines, and the HW_Arm_Sel bits map directly to the internal trigger signal: 0b000 - 0b111 map to 0d0 - 0d7. In order to route an I/O pin to an internal trigger, you must also write to a few more registers.
From what I've read, there are two more register families that need to be programmed: TG_x_LevelEdgeReg and TG_x_CombinationReg, where x is the internal trigger number. In your case, you only need one pin from the I/O connector to be your arm start trigger, so TG_0_LevelEdgeReg and TB_0_CombinationReg will suffice for your application.
TB_0_LevelEdgeReg :: Offset 0x660
TG_0_LevelEdgeReg is only 8 bits wide, and maps as follows:
7..6: EdgeMode
5..0: LESel
LESel selects the I/O connector pin to use as the source for the internal trigger signal. 0d0 - 0d39 will select the I/O pin of the same number. NB: behavior for TG_x_LevelEdgeReg is more limited for triggers 1-7, and only a small subset of the I/O pins can be selected for those trigger signals. Trigger 0 can use any I/O pin. Setting these bits to 0d63 forces the trigger source low, and can be used as a way to 'unroute' it when you're finished with your program.
EdgeMode determines whether the TIO will detect an edge of the incoming signal, or just pass the signal level straight through. When detecting edges, it will latch the signal and generate a single TIMEBASE3 pulse instead. 0b00 sets level mode; 0b01 sets rising edge; 0b10 sets falling edge; 0b11 sets either edge.
TG_0_CombinationReg :: Offset 0x6A0
TG_0_CombinationReg is 32 bits wide, and has three fields of interest:
19..16: CombFunction
5..4: CombTypeB
1..0: CombTypeA
CombTypeA controls which trigger subsystem to use as the source for the trigger signal. Since you're coming from an I/O pin and using the edge/level subsystem, you must set these bits to 0b01.
CombTypeB is similar to CombTypeA, and although you won't be using trigger B, set it to 0b01 to be safe.
CombFunction performs a simple logic function on A and B. Since you're only using a single I/O connector, you only need the A output, so set these bits to 0b1100.
All of the other bits should be set to 0b0.
Unfortunately, I'm unable to test these statements since my test machine is currently being used for another research project. Please let me know what happens if you decide to test.
Joe Friedchicken
NI VirtualBench Application Software
Get with your fellow hardware users :: [ NI's VirtualBench User Group ]
Get with your fellow OS users :: [ NI's Linux User Group ] [ NI's OS X User Group ]
Get with your fellow developers :: [ NI's DAQmx Base User Group ] [ NI's DDK User Group ]
Senior Software Engineer :: Multifunction Instruments Applications Group
Software Engineer :: Measurements RLP Group (until Mar 2014)
Applications Engineer :: High Speed Product Group (until Sep 2008)

Question - is JavaMail the choice for me? Mass email delivery.

Hello. I'm thinking about using JavaMail API, and I would like your feedback if JavaMail is the right choice for me.
I'm working on a J2EE app (running on Glassfish) that will send email out to multiple recipients. The critical parts are
1) It must scale so that it can send up to 10,000 email multiple times a day.
2) The servlet that sends out the email must have a descent performance (can't hang while sending out 10,000 email forcing the user to wait, but for the servlet to send out 10,000 emails....I expect a little delay)
So I'm using postfix for delivery with support for 10,000 recipients. I am thinking of using JavaMail inside a servlet which retrieves the 10,000 email addresses and creates 100 separate emails with 100 email recipients under BCC for each email.
I am sending out the email in bulks of 100 separate email each with 100 recipients under BCC to address performance.
Does my solution sound logical? Anything else I should be aware of?

I'm not speaking from personal experience since I haven't tried to build something
of the scale you're talking about, but...
I wouldn't expect the overhead of the JavaMail API to be a significant issue here.
Of course, you have to use the JavaMail API in a reasonable manner to get good
performance and scalability.
A lot depends on the performance of your server as well.
I would expect the most difficult part to be handling the inevitable failures (network, server, etc.)
that will occur when working at this scale.
100 connections to your mail server several times a day shouldn't be an issue, but your
mail server will be busy sending out all those messages.

I have a new email and am trying to change it in icloud. but it has locked me out and won't send my email a reset password link for some reason. even though it says its sent, it doesnt come to the email address

i have a new email so have a new apple ID now and am trying to change it in icloud. but it has locked me out and won't send my email a reset password link for some reason. even though it says its sent, it doesnt come to the email address. help!

Welcome to the Apple community.
If you are unable to remember your password, security questions, don’t have access to your rescue address or are unable to reset your password for whatever reason, your only option is to contact Apple ID Support, upon speaking to an operator you should explain that your problem is related to your Apple ID, this way you will not be charged for assistance, even if you don’t have an AppleCare plan.
You will need to show patience with the procedure and be prepared to demonstrate without question that the account belongs to you. Don’t expect access to be restored immediately and if you aren’t the owner of the Apple ID registered to the device the account won’t be reset.
This is answer is provided from my own database of boilerplate responses and the content was last reviewed and/or tested on: 2014/12/18

What is the best Mac choice for creating pro-level art/graphics/animation?

I'm an artist who does a lot of work with Adobe Creative Suite CS5, as well as some video editing and lots of animation. I've been using a 2007 model 15-inch Macbook Pro for the last 4 years, and it seems like it's time to upgrade...it runs burning hot all the time, and the battery dies pretty quick when the cord falls out. It seems like the whole thing is running a little slow, which is probably because I have a TON of graphics/animation/video software on there, but I need each and every program.
My question is, what is the best new Mac to purchase to replace this one? I want to make sure it lasts as long as possible, and will be able to handle the programs I use now. My first thought is to get another Macbook Pro, because of the portability, and just add on all the higher RAM, etc to customize it. But my husband suggested looking into the Mac Mini, because it's a lot cheaper, and we're a little strapped for cash at the moment. Would that serve the purpose? Or is a Macbook Pro really the best choice for what I need it to do?
I'd love to hear suggestions from other artists or graphics people. What do you recommend?

For a "cash strapped" person, unless you already
have a monitor, one of the new iMacs may be
a better choice. If you do have a monitor, I would
suggest the dual core i7 equipt MacMini. Since you state
you are using CS5 stuff, most Adobe apps,
Photoshop for example, do not make effective
use of multiple cores. Also, using any of the
Adobe products, regardless of which computer
you decide on, get as much RAM as you can afford.

Password choice for PBE

Similar Messages

Maybe you are looking for