<p>As per the comments to your main question, it is mainly the Java browser plugin that is the problem. I advise you not to be have that running.</p>

<p>Java for a desktop application is more like a supporting library to the applications you are installing. The usage is different.</p>

<p>It is a good idea to be security conscious with Bitcoin software - the question to ask is: How can rogue code get to run on my machine ?</p>

<p>If you download MultiBit from <a href="https://multibit.org" rel="nofollow">https://multibit.org</a> (and check its SHA256 hash and/or signature) and download the JDK from a reputable source then you know what you are running.</p>

<p>All that being said, if you still do not want to install Java then I would have a look at Electrum (<a href="http://electrum.org" rel="nofollow">http://electrum.org</a>) and see that meets your needs.</p>

CC BY-SA 3.0
2013-07-07T11:04:24.720Z
_If you download MultiBit from https://multibit.org (and check its SHA256 hash and/or signature) and download the JDK from a reputable source then you know what you are running_  I'm using Microsoft Windows 7 and the only Java that is available for it is Oracle's. Sadly the company has not fully patched all the security holes revealed so far.
user5556
CC BY-SA 3.0
2013-07-07T11:22:06.740Z
I have just surfed to Electrum's website. It seems that it only offers online wallet. I prefer to store my Bitcoins on my PC, not on some remote server. I can't afford to take any risks.
user5556
CC BY-SA 3.0
2013-08-13T07:29:28.417Z
@user5556 Here's an open source JDK: https://github.com/alexkasko/openjdk-unofficial-builds#openjdk-unofficial-installers-for-windows-linux-and-mac-os-x It doesn't have the browser plugin and thus not the security issues.
jobukkit
CC BY-SA 3.0
2013-08-13T08:24:35.670Z
@user5556: In Electrum the bitcoins are stored on your PC. You just use them with the help of a remote server for convenience, but it cannot take them, and you can use them without the remote server.
Meni Rosenfeld
CC BY-SA 3.0
2013-07-06T15:42:34.487Z
2013-07-06T15:42:34.487Z
jim618
<p>If Java is your only concern, <strong>just use MultiBit. It is safe to install Java. It's a common myth that Java is insecure. It is not. Only the browser plugin of Java is insecure. So, just install Java and then disable its browser plugin.</strong></p>

<p>EDIT: <a href="https://www.multibit.org/blog/2013/04/23/java-is-secure.html" rel="nofollow">The makers of Multibit confirm this.</a></p>

<hr>

<p><em>EDIT: Also, you say Java is proprietary software. It is. However, Sun made an open source version of it, <a href="http://openjdk.java.net" rel="nofollow">OpenJDK</a>. It doesn't include the browser plugin.
In case you don't use Linux or BSD: It's only for Linux and BSD however, but the closed one (that is also availible for Windows and Mac OS X) is largely based on the same source code, according to <a href="http://openjdk.java.net" rel="nofollow">OpenJDK's webpage</a>.</em></p>

<p><em>You also say "I hope the developers of MultiBit will drop the Java prerequisite in their next software version.". I hope you realise that would require a total (and unnecessary) rewrite of MultiBit?</em></p>

CC BY-SA 3.0
2013-07-10T11:59:23.273Z
@Pieter Wuille and Jop: If I were the chief developer of MultiBit, I would definitely rewrite the whole software. Why? Security must be the most important consideration especially when we are talking about money and how to store them safely.
user5556
CC BY-SA 3.0
2013-07-10T12:12:23.173Z
@user5556 You didn't read my answer except for the last line didn't you? **Java isn't insecure, it's only the browser plugin. It's completely safe to install it. Just remove the browser plugin afterwards**
jobukkit
CC BY-SA 3.0
2013-07-10T12:30:17.077Z
@user5556 Seriously, there is no point in not writing a piece of software in Java just because of the non-existent security problem
jobukkit
CC BY-SA 3.0
2013-08-13T01:34:05.020Z
+1 for @Jop for clarifying the java is insecure myth. Java on website is insecure, Java on desktops is not.
spuder
CC BY-SA 3.0
2013-07-07T14:07:48.243Z
2013-09-18T15:37:40.740Z
2013-09-18T15:37:40.740Z
jobukkit
<p>Most of you got this wrong!</p>

<p>When it comes to BitCoin, security must come first. It has become the target of many black hats lately.</p>

<p>While it is true that most of the security concerns with Java are based around the browser plugin, with MultiBit the issue is even worse - because what bitcoin clients (even multibit) do is they connect to IRC to gather network updates, and they work as both a network client (connect to other nodes and ask for data) and as a <em>server</em> (ready to give data to others). This makes the user even more vulnerable, because they might not even know that they are running in fact a server software on their desktop.
Note: it is possible Multibit doesn't have the server part as it doesn't store the whole chain, that would not help much, though.</p>

CC BY-SA 3.0
2014-10-19T12:30:51.397Z
Multibit is a thin SPV client, so it does not act as a server. Nevertheless, it is a complex network application, so it's certainly appropriate to be concerned about the security of both the application code itself and the underlaying technology (Java) as well. Just the fact that the "web plugin Java" is the vulnerable one does not mean the "desktop Java" is bulletproof. The only way to find out is to audit the code, which is obviously not feasible with the original (nonfree) Java VM implementation.
knaperek
CC BY-SA 3.0
2014-10-19T11:26:50.803Z
2014-10-19T11:26:50.803Z
Zviratko
<p>As of a few days ago, Bitcoin.org offers MultiBit instead of Bitcoin-Qt on its website: <a href="http://bitcoin.org/en/choose-your-wallet" rel="nofollow">http://bitcoin.org/en/choose-your-wallet</a></p>

<p>I do not wish to install MultiBit because it requires Sun Java to be preinstalled.</p>

<p>As we all know, Sun Java is full of security holes/exploits and according to The H Security at <a href="http://www.h-online.com/security/" rel="nofollow">http://www.h-online.com/security/</a> Oracle has not patched all of them. How can we trust our money with using a software that has full of security issues? (Note: Sun Java is proprietary software and end users are at the mercy of Oracle when it comes to fixing bugs.)</p>

<p>I hope the developers of MultiBit will drop the Java prerequisite in their next software version.</p>

CC BY-SA 3.0
2013-07-06T11:50:08.837Z
Security issues in Java aren't really relevant for desktop programs, as desktop programs already have full access to your computer.
Tom van der Woerdt
CC BY-SA 3.0
2013-07-06T15:31:18.813Z
If you want an open source alternative to the Oracle JDK there is also OpenJDK (for Linux). https://en.wikipedia.org/wiki/OpenJDK
jim618
CC BY-SA 3.0
2013-07-07T10:59:19.920Z
@Tom van der Woerdt: It doesn't matter whether desktop programs already have full access to my PC. If Java has security issues, it has issues.
user5556
CC BY-SA 3.0
2013-07-07T11:00:40.033Z
@jim618: I'm using Microsoft Windows 7. I don't think OpenJDK has support for Microsoft Windows.
user5556
CC BY-SA 3.0
2013-07-07T11:19:24.097Z
@user5556 The Java *browser plugin* has security issues, not the JRE itself.
Tom van der Woerdt
CC BY-SA 3.0
2013-07-09T02:16:55.410Z
@user5556 With that logic about Java, you should stop using windows then since it has security vulnerabilities. Oracle's insecure browser plugin has absolutely nothing to do with the security of Java
TheLQ
CC BY-SA 3.0
2013-07-10T12:02:42.147Z
@TheLQ: The difference between Microsoft and Oracle is that the former issues patches on a regular basis (the second Tuesday of the month) and almost immediately or the day after for the most important/significant security holes.
user5556
CC BY-SA 3.0
2013-07-10T19:39:29.357Z
Also, if you care about things being proprietary then why do you even use Windows instead of Linux...
jobukkit
CC BY-SA 3.0
2013-07-15T11:55:09.533Z
@Jop: You got me wrong. I am not against using proprietary software. It is only when companies like Oracle which does not take security issues seriously (as compared to Microsoft) that I hesitate using Sun Java.
user5556
CC BY-SA 3.0
2013-08-13T07:27:34.190Z
@newtoBTC You can update Java to 6 using Software Update.
jobukkit
<security><multibit>
Is there an alternative to MultiBit?
user5556
# Is there an alternative to MultiBit?

(Asked by: username_0 on 2013-07-06)

As of a few days ago, Bitcoin.org offers MultiBit instead of Bitcoin-Qt on its website: <http://bitcoin.org/en/choose-your-wallet>

I do not wish to install MultiBit because it requires Sun Java to be preinstalled.

As we all know, Sun Java is full of security holes/exploits and according to The H Security at <http://www.h-online.com/security/> Oracle has not patched all of them. How can we trust our money with using a software that has full of security issues? (Note: Sun Java is proprietary software and end users are at the mercy of Oracle when it comes to fixing bugs.)

I hope the developers of MultiBit will drop the Java prerequisite in their next software version.

**Tags:** security, multibit

> **Comments:**
> **username_1**: Security issues in Java aren't really relevant for desktop programs, as desktop programs already have full access to your computer.  
> **username_2**: If you want an open source alternative to the Oracle JDK there is also OpenJDK (for Linux). https://en.wikipedia.org/wiki/OpenJDK  
> **username_0**: @username_1: It doesn't matter whether desktop programs already have full access to my PC. If Java has security issues, it has issues.  
> **username_0**: @username_2: I'm using Microsoft Windows 7. I don't think OpenJDK has support for Microsoft Windows.  
> **username_1**: @username_0 The Java *browser plugin* has security issues, not the JRE itself.  
> **username_3**: @username_0 With that logic about Java, you should stop using windows then since it has security vulnerabilities. Oracle's insecure browser plugin has absolutely nothing to do with the security of Java  
> **username_0**: @username_3: The difference between Microsoft and Oracle is that the former issues patches on a regular basis (the second Tuesday of the month) and almost immediately or the day after for the most important/significant security holes.  
> **username_4**: Also, if you care about things being proprietary then why do you even use Windows instead of Linux...  
> **username_0**: @Jop: You got me wrong. I am not against using proprietary software. It is only when companies like Oracle which does not take security issues seriously (as compared to Microsoft) that I hesitate using Sun Java.  
> **username_4**: @newtoBTC You can update Java to 6 using Software Update.  

---

## 3 answers

### Answer by username_2 on 2013-07-06. Score: 3

As per the comments to your main question, it is mainly the Java browser plugin that is the problem. I advise you not to be have that running.

Java for a desktop application is more like a supporting library to the applications you are installing. The usage is different.

It is a good idea to be security conscious with Bitcoin software - the question to ask is: How can rogue code get to run on my machine ?

If you download MultiBit from <https://multibit.org> (and check its SHA256 hash and/or signature) and download the JDK from a reputable source then you know what you are running.

All that being said, if you still do not want to install Java then I would have a look at Electrum (<http://electrum.org>) and see that meets your needs.

> **Comments:**
> **username_0**: _If you download MultiBit from https://multibit.org (and check its SHA256 hash and/or signature) and download the JDK from a reputable source then you know what you are running_  I'm using Microsoft Windows 7 and the only Java that is available for it is Oracle's. Sadly the company has not fully patched all the security holes revealed so far.  
> **username_0**: I have just surfed to Electrum's website. It seems that it only offers online wallet. I prefer to store my Bitcoins on my PC, not on some remote server. I can't afford to take any risks.  
> **username_4**: @username_0 Here's an open source JDK: https://github.com/alexkasko/openjdk-unofficial-builds#openjdk-unofficial-installers-for-windows-linux-and-mac-os-x It doesn't have the browser plugin and thus not the security issues.  
> **username_5**: @username_0: In Electrum the bitcoins are stored on your PC. You just use them with the help of a remote server for convenience, but it cannot take them, and you can use them without the remote server.  

---

### Answer by username_4 on 2013-07-07. Score: 3

If Java is your only concern, **just use MultiBit. It is safe to install Java. It's a common myth that Java is insecure. It is not. Only the browser plugin of Java is insecure. So, just install Java and then disable its browser plugin.**

EDIT: [The makers of Multibit confirm this.](https://www.multibit.org/blog/2013/04/23/java-is-secure.html)

---

*EDIT: Also, you say Java is proprietary software. It is. However, Sun made an open source version of it, [OpenJDK](http://openjdk.java.net). It doesn't include the browser plugin.
In case you don't use Linux or BSD: It's only for Linux and BSD however, but the closed one (that is also availible for Windows and Mac OS X) is largely based on the same source code, according to [OpenJDK's webpage](http://openjdk.java.net).*

*You also say "I hope the developers of MultiBit will drop the Java prerequisite in their next software version.". I hope you realise that would require a total (and unnecessary) rewrite of MultiBit?*

> **Comments:**
> **username_0**: @Pieter Wuille and Jop: If I were the chief developer of MultiBit, I would definitely rewrite the whole software. Why? Security must be the most important consideration especially when we are talking about money and how to store them safely.  
> **username_4**: @username_0 You didn't read my answer except for the last line didn't you? **Java isn't insecure, it's only the browser plugin. It's completely safe to install it. Just remove the browser plugin afterwards**  
> **username_4**: @username_0 Seriously, there is no point in not writing a piece of software in Java just because of the non-existent security problem  
> **username_6**: +1 for @Jop for clarifying the java is insecure myth. Java on website is insecure, Java on desktops is not.  

---

### Answer by username_7 on 2014-10-19. Score: 0

Most of you got this wrong!

When it comes to BitCoin, security must come first. It has become the target of many black hats lately.

While it is true that most of the security concerns with Java are based around the browser plugin, with MultiBit the issue is even worse - because what bitcoin clients (even multibit) do is they connect to IRC to gather network updates, and they work as both a network client (connect to other nodes and ask for data) and as a *server* (ready to give data to others). This makes the user even more vulnerable, because they might not even know that they are running in fact a server software on their desktop.
Note: it is possible Multibit doesn't have the server part as it doesn't store the whole chain, that would not help much, though.

> **Comments:**
> **username_8**: Multibit is a thin SPV client, so it does not act as a server. Nevertheless, it is a complex network application, so it's certainly appropriate to be concerned about the security of both the application code itself and the underlaying technology (Java) as well. Just the fact that the "web plugin Java" is the vulnerable one does not mean the "desktop Java" is bulletproof. The only way to find out is to audit the code, which is obviously not feasible with the original (nonfree) Java VM implementation.  

---

