...
Note that a program that makes use of SSLSockets will block indefinitely if it tries to connect to a port that is not using SSL. Similarly, a program that does not use SSLSockets will block when trying to establish a connection through a port that uses SSL.
Exceptions
SEC15-EX1: Because of the mechanisms that SSLSockets provide to ensure the secure transfer of packets, significant performance overhead may result. If no sensitive information is being transmitted, or the channel is not prone to attacks, regular Sockets are sufficient.
Risk assesment
Using plain sockets instead of SSLSockets means that the data's confidentiality and integrity is not guaranteed.
...
Search for vulnerabilities resulting from the violation of this guideline on the CERT website.
Exceptions
SEC15-EX1: Because of the mechanisms that SSLSockets provide to ensure the secure transfer of packets, significant performance overhead may result. If no sensitive information is being transmitted, or the channel is not prone to attacks, regular Sockets are sufficient.
Bibliography
| Wiki Markup |
|---|
\[[API 2006|AA. Bibliography#API 06]\] \[[Gong 2003|AA. Bibliography#Gong 03]\] 11.3.3 "Securing RMI Communications" \[[Ware 2008|AA. Bibliography#Ware 08]\] \[[MITRE 2009|AA. Bibliography#MITRE 09]\] [CWE ID 311|http://cwe.mitre.org/data/definitions/311.html] "Failure to Encrypt Sensitive Data" |
...