File APIs for Java Developers
Manipulate DOC, XLS, PPT, PDF and many others from your application.
http://aspose.com/file-tools
The moose likes Applets and the fly likes Recording audio from applet (security problem) Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login
JavaRanch » Java Forums » Java » Applets
Bookmark "Recording audio from applet (security problem)" Watch "Recording audio from applet (security problem)" New topic
Author

Recording audio from applet (security problem)

Eva Adams
Greenhorn

Joined: Jan 12, 2004
Posts: 5
Hi!
I need to record audio with a java web based application from internet users.
Java Applet Policy doesn't allow record/play audio by default. You must certify and sign your applet, which is expensive and i'm only doing it for an academic project.
The other option is make the users change theirs policy files with policytool, but it's tedious for users, and also it's dangerous (if i tried to make something evil with their audio ), so much of them wouldn't like to do it.
I've been trying to pass this part of code to a servlet, but how on earth will the server know about the correct microphone, mixer, etc. that is using the client?
Please could anyone give me a solution, with or without servlets?
Joe Ess
Bartender

Joined: Oct 29, 2001
Posts: 8836
    
    7

Originally posted by Eva Adams:

I've been trying to pass this part of code to a servlet, but how on earth will the server know about the correct microphone, mixer, etc. that is using the client?

A servlet isn't going to help you for exactly the reason you cite here. You need privledged code running on the client. How about using Java Web Start to deploy the application to your clients?
EDIT: Upon further review, JWS requires that code that operates outside the sandbox be signed. However, the developer's guide describes how to create and use a "Test Certificate". Perhaps this is Good Enough for your purposes? Could probably use the test cert with an applet. . .
[ January 14, 2004: Message edited by: Joe Ess ]

"blabbing like a narcissistic fool with a superiority complex" ~ N.A.
[How To Ask Questions On JavaRanch]
Eva Adams
Greenhorn

Joined: Jan 12, 2004
Posts: 5
Thanks for the information, but i have the idea that test certificates must be signed by an authority like veriSign to be valid; and that cost money. Am i wrong? is there any possibility of getting a free (maybe with less permissions, etc) certificate?
Thanks in advance,
Eva
Joe Ess
Bartender

Joined: Oct 29, 2001
Posts: 8836
    
    7

The developer's guide describes creating a self-signed certificate:

The Java Web Start software presents a dialog displaying the application's origin, based on the signer's certificate, before the application is launched. Thereby allowing the user to make an informed decision whether to grant additional privileges to the downloaded code, or not.
. . .
Please note that a self-signed test certificate should only be used for internal testing, since it does not provide any guarantees about the identity of the user and therefore cannot be trusted. A trust-worthy certificate can be obtained from a certificate authority, such as VeriSign, and should be used when the application is put into production.

So it is different from a "trust-worthy" certificate that one would purchase. Try creating a self-signed cert, create a simple applet that opens a file on a user's local machine and try it out. If it works, you are in business.
Eva Adams
Greenhorn

Joined: Jan 12, 2004
Posts: 5
Thanks Joe
I'll try it
Eve
Eva Adams
Greenhorn

Joined: Jan 12, 2004
Posts: 5
Hi again
I've self-certified my jared applet with keytool/jarsigner, which it's suppossed to work with Java Plug-in. Since i used html-converter tool my applets execute directly with java VM and not with browser VM versions; so i haven't made more certifies (as .cab for microsoft, etc.)
Well it seems browsers ignore the certify and no even gives me a warning message asking if i trust the certificate or not, when i load the applet. Then, access to record audio is still denied.
Anyone knows what's the problem?
Sorry for boring you with this matter
Eva
Joe Ess
Bartender

Joined: Oct 29, 2001
Posts: 8836
    
    7

I ran through the example of creating a jar and signing it and I had some trouble at first. The JVM was picking up the .class files from the same directory I had the jar file so they weren't using the signed versions. I deleted the .class files and it works. In IE and Mozilla Firebird. It doesn't work with Appletviewer (SecurityException).
 
I agree. Here's the link: http://aspose.com/file-tools
 
subject: Recording audio from applet (security problem)
 
Similar Threads
Urgent: Is signed applet really necessary to read local files ?
Recording Audio Via JWS and XFer Using ftp
Download file on client machine at particular location
Apple + sound + permission
applet to servlet