How safe is WSIT username authentication with symmetric key?

Question

I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link).

How secure is this mechanism? Is this enough to protect against MITM attacks and data sniffing?

Answer 1

Looking at the linked article this looks very similar to standard web authentication in that the server has a certicate, the client uses username/password auth. to authenticate and then a shared key is used to encrypt communications.

So on that basis the answer to your question is similar to what it would be for standard web auth. Assuming that the client checks the validity of the servers certificate at runtime and that it posesses the means to check for things like certificate revocation it is reasonably likely to be protected against a MITM attack (unless the server certificate is compromised).

Data sniffing would be protected against the encryption of the data stream which appears from the docs to be done be symmetric encryption.