Java Installation and Security
Java, along with Flash and Adobe Reader, has been known to make Windows insecure for some time. Mac and Linux users now share that vulnerability.
Do You NEED Java?
Java is necessary only for certain features of LibreOffice, Apache OpenOffice and perhaps to allow other software to run on your computer.
If installed, I recommend disabling the Java plugin in your web browser — enabling it ONLY for trusted sites.
- Firefox 52 and later no longer support most NPAPI plugins, including Java.
- Firefox ESR runs Java. ESR is intended for system administrators in organizations.
- Legacy versions of Firefox disabled Java.
- Google Chrome no longer supports NPAPI plugins, including Java.
- Oracle is deprecating support for the Java browser plugin beginning with version 9.
- Internet Explorer supports Java, but is riskier because of its integration with Windows.
- Opera still supports Java, and is a better choice for Windows users that still need Java support in their browser.
Update Java Regularly
Update Java whenever updates are available. These releases fix security flaws in Java.
Version 9 & Later Not Supported in Browsers
Version remove all support for browser plugins, primarily because the major browsers no longer support them, largely a result of the rapidly growing mobile market that never supported Java.
Oracle has deprecated the Java browser plugin in Java Standard Edition Development Kit 9 (JDK 9). Deprecation is a warning for developers to stop using this technology. JRE 9 will continue to provide the Java Plugin and support launching applets on browsers that still offer standard plugin support, but is only available for limited use and not recommended. This browser plugin will be removed from the Oracle JDK and JRE in a future Java SE release. — Java.com
Avoid Third-party Software
Prevent Java Updater from installing third-party software.
- Open the Java Control Panel: Start ⇒ Control Panel ⇒ Java. If you see categories in the Control Panel, look for Java in Programs.
- Click on the Advanced tab.
- Scroll down to the Miscellaneous section at the bottom and place a check mark in “Suppress sponsor offers when installing or updating Java.”
If you uninstall Java, this setting will be removed, but as long as you de-select any optional software when downloading new Java versions and check during installation you shouldn't see third-party software installed on your system.
Uninstall Older Versions
I recommend uninstalling all previous versions of Java when updating. Old and unsupported versions of Java are a serious security risk and can leave your system vulnerable.
Uninstalling older versions of Java from your system ensures that Java applications will run with the latest security and performance improvements on your system. —Oracle
Java Updater May Not Remove Older Versions
Java's updater may not automatically remove all older versions, leaving your system vulnerable.
Oracle provides instructions for uninstalling out-of-date Java versions.
I recommend that you manually verify that older versions have been removed from your system.
Uninstall Option During Update
During installation of a new version, you should see the option to uninstall older versions:
You need to provide Java permissions to check for these and to enable Java (see Firefox & Java Security).
Uninstall Java when Updating
To secure your computer I recommend that you manually uninstall all current versions, cleaning out any remaining Java-related AppData entries before installing the most recent version available so you're running only the most recent version.
Manually Checking for Older Versions
Alternatively, you need to check to see if option to uninstall older versions has removed all older versions.
In either case, I recommend cleaning up the Java folders in AppData.
Cleaning Up AppData Java Folders
You need to be careful when following the instructions in this section. You can seriously harm your Windows installation if critical files are removed.
After running Java's Uninstall Older Versions option, I still found an obsolete Java version in the Sun AppData folder:
Cleaning Up Java Folders in AppData
Be sure you've either uninstalled Java (all versions) or have run the option to uninstall outdated versions before proceeding.
Like most Windows programs, Java keeps data in AppData (in folders labelled Oracle and Sun in the LocalLow folder).
To clean up obsolete Java folders, follow these instructions:
- Navigate to the Java folders by opening the AppData then LocalLow folders.
- Look for the Oracle and Sun folders and delete the appropriate folder(s):
- If you've uninstalled Java completely, you can delete both the Oracle and Sun folders.
- If you've only removed outdated versions, open the Sun folder then delete any folders containing older versions that is present (the jre1.8._45 folder in the above example).
The AppData folder is located in C:\Users\[user]\AppData. Navigate to the C: drive then open the Users folder and look for a folder with your user name. Inside you'll see the AppData folder (if you've made hidden files and folders visible).
Windows 10 users can use File Explorer to view the AppData folder. Windows 7 users can open their User folder (often located on their desktop) to view the AppData folder:
AppData Hidden by Windows
The AppData folder is normally hidden by Windows.
- Windows 7 users can change this in the Folder Options in Control Panel to show hidden files, folders and drives in the View menu.
- Windows 10 users can change this in File Explorer Options (search for “File Folder Settings”). Check “Show hidden files, folders and drives” in the View menu.
Firefox & Java Security
NPAPI-based plugins, including Java, are blocked in current versions of Firefox.
Beginning in Firefox version 52 released March 7, 2017, installed NPAPI plugins are no longer supported in Firefox, except for Adobe Flash. Some of the plugins that will no longer load in Firefox, even though they may be installed on your computer, include Java, Microsoft Silverlight and Adobe Acrobat. — Mozilla Support
Java Blocked in Legacy Versions
Beginning with version 17, Firefox disabled the Java plugin on computers running Windows and running Java 7 Update 11 or earlier (the dark grey box on the right). Java warns you before allowing the vulnerability to be exploited.
You'll likely see a warning similar to the light grey one shown on the right for Java 7 Update 13 or later.
- Be sure to allow Java to run ONLY on sites you trust. Java exploits can infect your computer.
- I recommend not telling Java to remember the setting. The site may become dangerous in the future and the reminder that Java can be unsafe helps to keep you vigilant.
How to Use Java if it is Blocked
Mozilla support provides instructions on how to allow Java on trusted sites (e.g. for Pogo.com).
- This workaround will not allow you to run Java in Firefox version 52 or later.
- Opera is recommended if you need to run Java on sites like Pogo.
- With the release of Java version 9, all support for browser plugins will be gone.
Update to the Most Recent Version
Download the latest version of Java for your operating system:
- Oracle's Consumer Java Site.
- Get the latest Java version.
- The Java Downloads for All Operating Systems page has offline installers for various installations.
- You can test your Java installation on the Java Verification page.
Java for Windows
Windows System Requirements are relatively minor and Windows 10 (8u51 and above), Windows 8.x Desktop, Windows 7, Windows Server 2008 R2 SP1 (64-bit) and Windows Server 2012 and 2012 R2 (64-bit) are supported.
A Pentium 2 266 MHz or faster processor with at least 128 MB of physical RAM is recommended. You will also need a minimum of 124 MB of free disk space.
32- or 64-Bit?
Java support in browsers is fast disappearing even as the use of 64-bit browsers is gaining strength. Most browsers already block Java even if it is installed. The upcoming release of Java version 9 will no longer support Java within browsers.
However, Java is also used by programs like LibreOffice and OpenOffice for certain functions.
It is recommended that you install 64-bit Java on 64-bit systems; 32-bit otherwise. If you have both versions installed, you'll have to update both for security reasons. It is safer to uninstall Java if you no longer require it.
Java for Linux
- How to install Java for Linux.
- See Java Downloads for All Operating Systems for offline installers for Linux.
Java for Mac
Installing Java on the Mac has changed with newer version (Oracle's Java version 7u25 and below have been disabled by Apple in OS X).
- Java 8 requires an Intel-based Mac running Mac OS X 10.7.3 (Lion) or later and administrator privileges for installation.
- Apple supplied their own version of Java for Java versions 6 and below and used the Software Update feature on the Apple menu to check for the most current Java available for your Mac.
- Apple's Get Java for your Mac now directs you to the Oracle site.
- See Oracle's Java Downloads for All Operating Systems for offline installers for the Mac and the Mac download FAQ.