I have a web service and an application that connects to it. I do not expose the web service via any discovery protocol to the outside world. I have two security mechanisms:
- My software uses SSL and encrypts all messages using a public/private key mechansim.
- I use WCF WIF integration username/password authentication, so my application has a unique user name and password which allows it to access the web service.
Now, if the user installs a sniffer such as Fiddler on his machine and installs the special certificate that allows fiddler to sniff https traffic:
- Will it allow it to analyze my web service methods structure?
- Will the user be able to reverse engineer the user name and password of my application and access my web service?
- Will the user then be able to build his own messages (REST/SOAP) and interact with my web service?