Page History

...

The principal protections included in SSLSocket that are not provided by the Socket class are [API 20062014]:

• Integrity Protection: SSL protects against modification of messages by an active wiretapper.
• Authentication: In most modes, SSL provides peer authentication. Servers are usually authenticated, and clients may be authenticated as requested by servers.
• Confidentiality (privacy protection): In most modes, SSL encrypts data being sent between client and server. This protects the confidentiality of data so that passive wiretappers won't see sensitive data such as financial information or personal information of many kinds.

...

Note that this rule lacks any assumptions about the integrity of the data being sent down a socket. For information about ensuring data integrity, see SER02-J. Sign then seal sensitive objects before sending them outside a trust boundary.

Noncompliant Code Example

...

Note that SSLSocket does not validate host names, so providing an arbitrary host name to an SSLSocket is still vulnerable to a man-in-the-middle attack. Host names should be validated separately. The HttpsURLConnection class validates host names and is a suitable solution for secure web sockets.

Exceptions

MSC00-J-EX0: Because of the mechanisms that SSLSocket provides to ensure the secure transfer of packets, significant performance overhead may result. Regular sockets are sufficient under the following circumstances:

• The data being sent over the socket is not sensitive.
• The data is sensitive but properly encrypted (see SER02-J. Sign then seal sensitive objects before sending them outside a trust boundary for more information).
• The network path of the socket never crosses a trust boundary. This could happen when, for example, the two endpoints of the socket are within the same local network and the entire network is trusted.

...

Use of plain sockets fails to provide any guarantee of the confidentiality and integrity of data transmitted over those sockets.

Automated Detection

The general case of automated detection appears to be infeasible because determining which specific data may be passed through the socket is not statically computable. An approach that introduces a custom API for passing sensitive data via secure sockets may be feasible. User tagging of sensitive data is a necessary requirement for such an approach.

Related Guidelines

Bibliography

...

...