|
Java Content in the Browser — Application Publisher Security MessagesThis article applies to:
Starting with Java 7 Update 21 (7u21), April 2013, all browser based Java content (Applets and Applications) will present additional information and require confirmation before being allowed to run. OverviewThe Java 7u21 release introduces changes to security messages related to running Java applets and applications. All Java applications executed via the user’s browser will prompt the user for confirmation. The type of messages presented depends upon different risk factors such as running applications that include invalid digital certificates, and using out of date versions of Java. See the Security Dialogs FAQ for an overview of the security messages.Low risk scenarios present very minimal messages. They include a checkbox to prevent the display of similar messages for applications provided by the same vendor in the future. Higher risk scenarios, such as running unsigned applications, require further interaction. For developers and system administrators, more technical information about the signed code change is available. What changes are being introduced?Java 7u21 introduces behavior changes to Java in the browser. The changes encourage application developers and vendors to include a digital certificate from a Certificate Authority with their applications. Users will be presented with additional information to help decide if the application should be executed.What is a Certificate Authority?A Certificate Authority is a trusted third party, typically a commercial business, that issues digital certificates. The certificates are issued to organizations or individuals after verifying their identity. The digital certificate is added to computer applications to validate that the application came from the owner of the certificate. For more information, see http://wikipedia.org/wiki/Certificate_authorityWhy are these changes important?Java in the browser is a popular target for attackers. Starting with 7u10 in 2012, Java introduced user configurable settings that only allow ‘trusted’ applications to be run. Trusted applications include a valid digital certificate issued by a Certificate Authority. Applications need to be explicitly approved by the end-user before they can run. Digital certificates provide more information on the identity of application provider, and help enforce accountability of application providers for the safety of the applications they provide.Will these changes break the applications I normally run?The changes in 7u21 should not break any applications you normally run, though they may require additional approval before starting. By default, Java will not begin running any Java application before you have given it permission by clicking 'run'. In high-risk scenarios, the user is provided an opportunity to prevent the application from running.What additional steps can I take to ensure the security of systems running Java applications in the browser?Java users, system administrators and developers are strongly encouraged to keep systems up-to-date with the latest versions. The Java auto-update mechanism is designed to keep Java users up-to-date with the latest security fixes.If you have previously turned auto-update off, re-enable auto-update to ensure that you have the latest and most secure Java installation on your system. See Java 6 Auto-Update to Java 7 FAQ for more information.
|
Printable Version