Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs.

I know there are many payment services available. One of these is Authorize.net, which I think I will use. When a user pays for a book, he/she will get a unique link to download data from the server. I want to prevent other users who has unlawfully retrieved that link from downloading data. Additionally, I want to keep users' payment information secure.

I have no experience in security. So, please give some advice on how to implement this. Thanks.

share|improve this question

1 Answer

up vote 4 down vote accepted

Hacking is creativity. Applications are complex and when an attacker can look at the entire application he can see interesting ways of abusing it. In the light of a few sentences explaining some vague application I would consider the following:

1)The OWASP top 10

2)Make sure you verify the SSL certificate when connecting to the APIs you need.

3)Avoid cryptography whenever possible. It can cause a lot of problems especially if you are not a dedicated cryptographer.

4)You cannot control the client, avoid CWE-602 violations.

share|improve this answer
1  
I assume that you mean by "avoid cryptography", avoid building it, not using it, correct? I would also add relevance of PCI:DSS requirements... – AviD♦ Oct 23 '12 at 11:27
@AviD considering he just used SSL I can only assume that is what he meant. – ewanm89 Oct 23 '12 at 12:35
@AviD♦ well it should be avoided in favor of another system if possible. Often cryptography is the only tool that can be used, and that is perfect place for it. – Rook Oct 23 '12 at 16:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.