Are there security concerns with using J/Link? If so, is there any way to encrypt the data passed between Mathematica and Java? If Mathematica and the JVM are running on the same machine, is there any reason to worry about this?
Bottom line is (and I've discussed this with the developer of JLink): you can NEVER make it TOTALLY impossible within the Mathematica system, because it's impossible to prevent man-in-the-middle attacks. You can enrypt/decrypt on both sides (the kernel and the JVM), but for decryption you always need to tell the other side a public or private key. You can make this really powerful and inordinately difficult, but in the end, you can never exclude the possibility of a MITM attack where someone reads packages with the LinkSnooper and then simply pretends to be the "other side".
It's one of those questions where "secure" and "impossible" have different meanings for different people. "Entirely secure" is impossible, simply because all kernel interactions with anything outside of the kernel is done with MathLink, and that can be snooped, and you can pretend to be (mimick) the corresponding other side. But for some people "secure" already means when something is difficult enough to spend an inordinate amount of effort (=time and other resources) on it. A skilled cryptographer can make it difficult enough that it's practically infeasible to hack into it. But the extremely powerful theory of MITM attacks (which are, at least in my opinion, the most powerful crypto attacks of all that don't require a government lab for a brute-force approach), together with the snoopability of all MathLink traffic rule out a total security.
But, for all practical purposes, you can make the encryption strong enough, even for commercial applications.
|show 3 more comments|