4

I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs.

I know there are many payment services available. One of these is Authorize.net, which I think I will use. When a user pays for a book, he/she will get a unique link to download data from the server. I want to prevent other users who has unlawfully retrieved that link from downloading data. Additionally, I want to keep users' payment information secure.

I have no experience in security. So, please give some advice on how to implement this. Thanks.

1 Answer 1

4

Hacking is creativity. Applications are complex and when an attacker can look at the entire application he can see interesting ways of abusing it. In the light of a few sentences explaining some vague application I would consider the following:

1)The OWASP top 10

2)Make sure you verify the SSL certificate when connecting to the APIs you need.

3)Avoid cryptography whenever possible. It can cause a lot of problems especially if you are not a dedicated cryptographer.

4)You cannot control the client, avoid CWE-602 violations.

3
  • 1
    I assume that you mean by "avoid cryptography", avoid building it, not using it, correct? I would also add relevance of PCI:DSS requirements...
    – AviD
    Oct 23, 2012 at 11:27
  • @AviD considering he just used SSL I can only assume that is what he meant.
    – ewanm89
    Oct 23, 2012 at 12:35
  • @AviD♦ well it should be avoided in favor of another system if possible. Often cryptography is the only tool that can be used, and that is perfect place for it.
    – rook
    Oct 23, 2012 at 16:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .