Java security: from HotJava to netscape and beyond

Drew Dean, Edward W. Felten, Dan S. Wallach

Research output: Contribution to journalConference articlepeer-review

138 Scopus citations


The introduction of Java applets has taken the World Wide Web by storm. Information servers can customize the presentation of their content with server-supplied code which executes inside the Web browser. We examine the Java language and both the HotJava and Netscape browsers which support it, and find a significant number of flaws which compromise their security. These flaws arise for several reasons, including implementation errors, unintended interactions between browser features, differences between the Java language and bytecode semantics, and weaknesses in the design of the language and the cytecode format. On a deeper level, these flaws arise because of weaknesses in the design methodology used in creating Java and the browsers. In addition to the flaws, we discuss the underlying tension between the openness desired by Web application writers and the security needs of their users, and we suggest how both might be accommodated.

Original languageEnglish (US)
Pages (from-to)190-200
Number of pages11
JournalProceedings of the IEEE Computer Society Symposium on Research in Security and Privacy
StatePublished - 1996
EventProceedings of the 1996 17th IEEE Symposium on Security and Privacy - Oakland, CA, USA
Duration: May 6 1996May 8 1996

All Science Journal Classification (ASJC) codes

  • Software


Dive into the research topics of 'Java security: from HotJava to netscape and beyond'. Together they form a unique fingerprint.

Cite this