Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link).

How secure is this mechanism? Is this enough to protect against MITM attacks and data sniffing?

share|improve this question
How secure usually depends on who your threats are. Who do you expect to try to break it and what are their motives (profit, fun, etc..)? – this.josh Nov 29 '12 at 1:12

Looking at the linked article this looks very similar to standard web authentication in that the server has a certicate, the client uses username/password auth. to authenticate and then a shared key is used to encrypt communications.

So on that basis the answer to your question is similar to what it would be for standard web auth. Assuming that the client checks the validity of the servers certificate at runtime and that it posesses the means to check for things like certificate revocation it is reasonably likely to be protected against a MITM attack (unless the server certificate is compromised).

Data sniffing would be protected against the encryption of the data stream which appears from the docs to be done be symmetric encryption.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.