A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...
-3
votes
1answer
67 views
Security of web services (REST & SOAP) [closed]
I'm doing a state of the art on web services security. I need every bit of a solution out there that solves concerns about identification, access control, transmission related ones like data ...
2
votes
1answer
67 views
How to Verify the Identity of the Caller of a Web Service
I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself.
Now, my question is, how do I ...
6
votes
3answers
378 views
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?)
LivingSocial - 50 Million Users Exposed
Zappos - 24 Million ...
4
votes
2answers
81 views
How Secure are Authenticity Token in Rails
I came across a website which uses Rails Authenticity token to prevent CSRF attacks. My concern here is that I can see the authenticity token in the source code of the web page. If any other service ...
2
votes
1answer
99 views
User Authentication API
I'm developing a web API for a user database that will be used to verify a given username / password combination is valid.
I'm just looking for comments / criticism on the following method that I'm ...
1
vote
2answers
94 views
Question about HTTPS [duplicate]
I have a question about HTTPS, which I need help understanding.
So if I type: https://www.facebook.com/FOOBAR and as the connection is encrypted, will someone in the middle (say my ISP or someone who ...
-2
votes
1answer
32 views
What is the notion challenge in authetication?
Can someone help me what is a challenge in authentication wordbook?
1
vote
3answers
171 views
Task Manager and Keyloggers
I know that some of the best keyloggers can't be viewed from the Task Manager.
Where can one see if such keyloggers are running on the system? Will they be in the Windows Services or are they hidden ...
2
votes
1answer
68 views
Best practices for setting up client connections to a server with app credentials
The question title is... ugly to say the least. Here's an overview of what I've got:
I work on an online tool. Data is sent to it, it processes the data (an intensive task) and sends results back.
...
2
votes
1answer
94 views
What attacks are most likely against SSL/TLS web service sessionid?
I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the ...
3
votes
2answers
88 views
Securing Java web services called by web site in DMZ using web services for communication
Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
1
vote
1answer
208 views
iOS auth/auth with a REST Webservice
we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend ...
0
votes
2answers
63 views
Why do services like Twitter have tokens and secrets for 3rd party apps?
I noticed that if you have a 3rd-party Twitter app, you get an access token, and an access token secret, to communicate with Twitter.
Why are there two codes? Shouldn't one be enough?
Does this mean ...
3
votes
1answer
213 views
Is there cryptographic material in a phone's SIM card that can be used with RSA encryption?
Given that a smart card stores a private key that can't be extracted, it appears that a SIM card is similar to a smart card in these respects.
I need to store (or use an existing) private key on a ...
3
votes
3answers
250 views
web services: how prevent illegal accesses
As suggested by someone I post a question here (for the first time). I'm using web services from an Android application. I use https (I bought a SSL certificate).
I want to prevent unwanted accesses ...
1
vote
4answers
142 views
Tracking a user who has posted abusive messages
A visitor to our site has posted abusive messages and I wish to block them but I'm not sure there's much I can do besides blocking their IP address (and even that won't help much).
After analysing ...
4
votes
3answers
247 views
February 7th 2013 Facebook integration error implications [duplicate]
What are the security, privacy, and overall availability implications of the Facebook event (link) yesterday? I was astonished to see site after site being redirected to a Facebook error page last ...
-1
votes
4answers
107 views
Is there any way to know the contact email on a contact form? [closed]
When a website has a contact form where the email isn't shown, is there any possible way of know to which email is the contact form sending the message?
0
votes
1answer
73 views
Securing the SOAP Messages
One of my clients wants to encrypt few sensitive information which will be transferred through webservices / SOAP.
My client has the following suggestions:
Encrypt the sensitive data with AES ...
0
votes
2answers
110 views
Denial Of Service attack in asynchronous communication
Is Low rate DOS attack (unintended) possible through asynchronous communication? Consider this scenario:
I have a client server application were there is a WAN communication between the client and ...
1
vote
3answers
110 views
RSS Feeds: restrict access
"We are a bunch of journalists and we share much of the information via e-mails. This has become tedious now. Hence we found out a way to share, by just having to share our private blog posts via ...
1
vote
1answer
181 views
How does a developer interact with Microsoft Certificate *Web Services*
Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
1
vote
2answers
104 views
Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?
I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
-7
votes
2answers
91 views
What are the vulnerabilities of a social network ? (I would like to create one myself) [closed]
I am currently enrolling in a computer science class, however haven't learned about databases or security on the internet in general. I have had a lot of programming and database experience before ...
1
vote
2answers
83 views
How do private feeds get transferred between two different portals?
I have some doubts about how the RSS private feeds, get transferred between one portal to another.
The whole point is to allow private RSS feeds to be consumed by external clients, and in 99% of ...
6
votes
2answers
172 views
Safe YAML parser?
I've recently read that YAML was not "designed to handle malicious user input", because a malicious YAML input "can create instances of all classes defined in the targeted Rails application". ...
4
votes
4answers
504 views
Why would someone want to encrypt RSS feeds?
I heard the idea of encrypting the RSS feeds using public key encryption system from someone and since then I am intrigued by the idea. But then I started to wonder what would be the basic need for ...
1
vote
2answers
113 views
How do I holistically protect a web service from network and MITM attacks?
I have several financial web services that are accessed over HTTPS, however the client devices may be accessing the web services over untrusted WiFi, through questionable proxies, and possibly ToR ...
1
vote
2answers
543 views
What does scorecardsresearch.com/beacon.js - added by Disqus.com - do?
I recently added Disqus to my site. Looking at the "scripts" tab on Firebug, I noticed a script called, http://scorecardresearch.com/beacon.js (here is a prettified version - the script is not ...
2
votes
2answers
130 views
Is there any way to differentiate between a normal web request and a web service request?
I have a security layer for providing the security of the requests that come to my server. For all web request that come in a login page is shown if cookie is not present. I am now introducing web ...
1
vote
1answer
98 views
How safe is WSIT username authentication with symmetric key?
I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link).
How secure is this mechanism? Is this enough to ...
3
votes
3answers
183 views
Monitoring for security threats
I host and maintain several websites. The users pay to have their sites maintained and secured. However, with the amount of web applications like joolma, wordpress, ect... and their plugins, I need a ...
3
votes
1answer
148 views
Payment security on Android App
I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs.
I know there are many payment services available. One of ...
6
votes
2answers
283 views
Does anyone use XML Encryption?
The XML standard defines a mechanism for encrypting the data in a XML document. It's part of the standard.
Does anyone use this XML encryption format? Are there any significant deployed systems ...
0
votes
1answer
105 views
Is it dangerous to serve executable cgi files in public folder?
In the past, Apache used to serve cgi files from cgi-bin folder only, and it was always advised to avoid putting executable files in public folders. However, today's webservers fairly serve executable ...
3
votes
2answers
757 views
How can I prevent reflected XSS in my JSON web services?
I have a web service that takes POST data (JSON) and returns part of the request object in the JSON response.
This is open to XSS if the response is rendered as HTML by the browser since someone ...
4
votes
2answers
249 views
Webservices exploitation / axis/services/AdminService?Method=AdminService
I'm writing to get some stuff on hardening some web-services, but I'm looking also for some tool to test web-services.
I have a sandbox (can't post live URLs...)
I'm trying some stuff to try to ...
2
votes
1answer
1k views
How to implement an API-Key-Mechanism
first of all: I am quite unsure about the questions title, so if you have a better idea, please feel free to tell (:
I would like to know about best-practise examples where services (like Twitter or ...
3
votes
4answers
470 views
Is it okay for API secret to be stored in plain text or decrypt-able?
Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
3
votes
5answers
589 views
How to secure a server backend
I am developing a server which serves two purposes: it is a CMS for people to use and maintain some data, and a Web Service for a mobile app to get this data. It runs on a Debian server running Tomcat ...
4
votes
3answers
261 views
What are the risks of posting my email address to pwnedlist.com?
pwnedlist.com claims to have details of over 23 million accounts that have been hacked, and if you submit your email address they'll apparently tell you if you're in the database.
Are the people ...
4
votes
1answer
1k views
Facebook page receiving improbable amount of likes from unknown users
A bit of an odd problem, but I'm not totally sure where to post this.
I am an administrator for a facebook page that suddenly began receiving hundreds of likes in the past few days. This trend began ...
1
vote
1answer
238 views
How secure is github's whitelisting CORS domains?
The Github API allows you to make requests using CORS [1]. The CORS requests are only allowed by certain whitelisted domains :
Any domain that is registered as an OAuth Application is accepted.
...
3
votes
1answer
222 views
What are the security risks when using free Content delivery networks (CDNs)?
I was doing some research on Content Delivery Networks. For those who don't know, a CDN is a large collection of servers that cache and quickly serve up static content such as images, css, js, etc, to ...
2
votes
1answer
125 views
Are these merchant integration instructions wrong about server-client interaction?
I'm working with a payment gateway that seems to have a fundamental misunderstanding of "clients" and how to protect sensitive data.
The integration instructions are mostly about a "redirect" mode of ...
6
votes
6answers
3k views
Securing an API for mobile access
I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
5
votes
3answers
419 views
Is it a security risk to embed a commenting service (like Disqus) into our site?
Can commenting services like Disqus, IntenseDebate, etc. pose a security risk for corporations?
Edit:
What risks could arise when embedding such services into corporate websites?
3
votes
1answer
192 views
Is there a spreadsheet/template for Mapping WebServices Authorization Rules?
I'm looking for a spreadsheet/template that allows the business-rules (i.e. 'who has access to what') to be mapped, visualized and analyzed.
In the past I have created a couple of these (some even ...
0
votes
1answer
228 views
Web Service Security
We are currently designing a Web Service that returns a JSON formatted messages. The following are the planned implementation for the service's security:
An SSL Certification to the service for the ...
1
vote
1answer
146 views
How can a SAML Relying Party redirect to one of two IDPs?
We need to support the following Authentication flows
User 1 logs into Salesforce using Salesforce Credentials
User 2 logs into Salesforce using Arcot +Ping + Siteminder credentials
User 2 logs into ...
