Future of JavaApplets

[mLipok]

Recently @Danp2 post here:

Interesting link to url:

https://blog.mozilla.org/addons/2015/08/21/the-future-of-developing-firefox-add-ons/comment-page-3/

There is description about future of FireFox add-ons   developing.

 

I linked this to other facts, such as the lack of support for JAVA applets in Google Chrome and FireFox.
I wonder when JAVA stops being supported in InternetExplorer.

Why do I think about it and why do I write about it in Developer Forum?
Because these changes have a second bottom, it means deeper problems.

Which service based on cryptographic card authorization, or to digitally sign data via cryptographic cards, does not use JAVA applets?

I personally do not know such.
Some of you, will ask me how important it is?

Well, without that you can not talk about eDocuments, eServices, eGovernment.

So the question is how do you see the future without JAVA applets?

 

Regards,

mLipok

[steveeye]

Applets have been an apart of the web almost twenty years since their release in 1995 and they are still being used on the internet, especially, behind firewalls. However, given the exponential technological growth, it should run its course in next few years

[TheDcoder]

I think it would be fair to say that JavaScript is taking the place of Java Applets... especially after the invention of asm.js (and source-to-source compilers like Emscripten). Many have converted cryptographic libraries like OpenSSL. This allows cryptographic operations (signing, verifying, decrypting and encrypting) in the browser itself. A good example would be Keybase.

[mLipok]

This is interestning, but at the same time this is not what I'm worry about.
Did you ever use a qualified certificate issued by a qualified exhibitor ?
But in such a way that the electronic activity contained in the electronic document has the same legal effect as the handwritten signature ?

This is not a question of buying a washing machine, but serious official documents, even at the ministerial level.

Has anyone seen a solution based on a website that uses qualified signatures, or possibly or non-qualified signatures but issued by banks or government agencies, on cryptographic cards that are used on a web or intranet site, using cryptographic cards, and for that Using a different technology than JAVA applets ?

The last sentence is translated by using GoogleTranslate - sorry for the complexity of the case and the description.

Edited June 2, 2017 by mLipok

[TheDcoder]

I guess my answer is "No" to all of our question, I don't even know what a "cryptographic card" is. But from what I have read until now, it looks like something the government approves and treats it equal to a handwritten (drawn?) signature.

No wonder why they are still using Java applets for this technology... They are not interested in migrating this tech to newer software/hardware frameworks because in this point of time we have much simpler things which can be equally secure(?)... I am referring to PGP in particular

[mLipok]

3 minutes ago, TheDcoder said:

it looks like something the government approves and treats it equal to a handwritten (drawn?) signature.

Yes.
Search for: 
cwa 14170 security requirements for signature creation applications

also you can look here:
http://www.etsi.org/deliver/etsi_ts/102100_102199/10217601/02.01.01_60/ts_10217601v020101p.pdf

and here:

https://pl.scribd.com/document/106942242/Enhancing-the-reliability-of-digital-signatures-as-non-repudiation-evidence-under-a-holistic-threat-model

 

[TheDcoder]

Those documents are very technical... something a 16 year old couldn't understand

3 minutes ago, mLipok said:

https://pl.scribd.com/document/106942242/Enhancing-the-reliability-of-digital-signatures-as-non-repudiation-evidence-under-a-holistic-threat-model

Only the introduction paragraphs are visible, rest of the pages starting from the contents require a paid subscription

[iamtheky]

There is software that will run the java applets to authenticate certificates/signatures (Common Access Cards) without JAVA.   IcedTea does it for Linux, but it is based off an open source project that's been forked for everyone.

[mLipok]

8 minutes ago, TheDcoder said:

They are not interested in migrating this tech to newer software/hardware frameworks because in this point of time we have much simpler things which can be equally secure(?)... I am referring to PGP in particular

The point is that the certificate issuer (intermediary office) certifies that the certificate holder is the person.
For GPG, authentication is a matter of trust between the parties exchanging information, and it is rather the nature of encryption.

In my case, we are not talking about encrypting but signing documents in such a way that there is no doubt when and who did the legal action, such as a notary transferring the property and a second act of recording the act in the ministerial system.

[mLipok]

21 minutes ago, iamtheky said:

There is software that will run the java applets to authenticate certificates/signatures (Common Access Cards) without JAVA.   IcedTea does it for Linux, but it is based off an open source project that's been forked for everyone.

Each certificate issuer also makes available the sale of hardware and software, including the one you mention.

The problem is that many systems use signing files in "ONLINE" mode. Because it does not require manually writing the file to disk, SIGNING, and its subsequent manual upload to the portal.

 

As an example go here:
https://wws.ceidg.gov.pl/ceidg.sts/Login.aspx

and click:

Quote

Certyfikat
Zaloguj przy użyciu certyfikatu

This is a business portal where you can deal with official matters, including those with the tax office.
 

Second example: Here:
https://www.zus.pl/portal/riu/riuZalogujLoginHaslo.npi
you can handle matters related to national social security in Poland.

 

These two examples allow you to sign in to government systems using a signature issued by the certification center, without having to use external applications.

Of course do not try to use your certyficate and do not use your PIN for them

Edited June 2, 2017 by mLipok
added word SIGNING

[iamtheky]

Understood, I always forget there are other governments.  I also tend to forget that people implement tech differently.

My blinders are loosening, but not quick enough for my liking.

[anthonyjr2]

Is there really no other way to do certificate handling without Java? I'm sure they can come up with a more secure protocol to use that could be dedicated to just authentication and security. Java at the moment is filled to the brim with holes and security issues, and I personally support its phasing out in popular browsers.

I have a lot of experience with Java applets because the medical field is absolutely filled with them, and there is also the fact that most of them only run on Java 1.6 or less which is completely filled with bugs and opportunities for malware to take over. It seems with every Java update a million more flaws in its security are found 

[mLipok]

1 hour ago, anthonyjr2 said:

Is there really no other way to do certificate handling without Java?

I'm asking about this here ? What is the future of JavaApplets but in relation to using with CryptoCard and certificates.
Maybe my question should be:  Do you know any nonJava solution for this kind of task ?

1 hour ago, anthonyjr2 said:

I have a lot of experience with Java applets

So you should know what I'm asking and  for that  you should know the answer for your question which I quote in this post .... or at least I hope/think so.

 

Edited June 2, 2017 by mLipok

[anthonyjr2]

Sorry, I wasn't challenging you or anything. When I say I have a lot of experience with Java applets, I meant experience with being a user of them. I don't create them myself or really get involved in the backend of how they work. I was under the impression that you were saying Java was the only way to do things like this.

[mLipok]

8 hours ago, anthonyjr2 said:

I was under the impression that you were saying Java was the only way to do things like this.

I hope there is another way.

8 hours ago, anthonyjr2 said:

Sorry, I wasn't challenging you or anything.

No problem. I also not challenging you.
I was just hope you know this, but the problem was in my poor description.

 

[mLipok]

For this who are interested in please read also about:
Regulation of the European Parliament and of the Council on electronic identification and trust for electronic transactions in the internal market.

 

Edited June 6, 2017 by mLipok