Mysql – Connecting MySQL database remotely on a hosting provider secure

javaMySQL

My JavaFX Desktop Application is currently connected to a hosted MySQL database remotely on bluehost. I query "SELECT", "UPDATE", "DELETE" on my JavaFX Application and successfully done.

My question is. Is this approach secure?

I am using JDBC driver to connect through it. 

DriverManager.getConnection("jdbc:mysql://mysql_ip_on_bluehost_here:3306/my_db", dbUser, dbPass);

Best Answer

No it isn't secure. From a sysadmin point of view: both your credentials as well as all data will be transmitted unencrypted.

Although MySQL does support transport layer security (SSL/TLS) it isn't enabled by default and after setting up server support you'll need to explicitly instruct the client to use it as well.

Typically that would result in something along the lines of:

DriverManager.getConnection("jdbc:mysql://mysql_ip_on_bluehost_here:3306/my_db?useSSL=true", dbUser, dbPass)

An alternative would be something like IPSec that provides security on the IP layer rather than the application layer.

From a DBA point of view @M_dk made a good point that allowing direct SQL UPDATE and DELETE statements are not desirable and stored procedures are much better from a security perspective.

Related Topic