Hot answers tagged

18

To cite the important part from the article you refer to: The disadvantage is that this kind of security is applied separately on each hop in the communication path, making the communication susceptible to a man-in-the-middle attack. TLS is used in different use cases. Some of these cases involve a single end-to-end transport of the message, for example ...


8

Imagine two different scenarios: Typical/direct calls You have a client and a server. The client sends a message to the server; the server does something with the request, creates a response, and voids the memory that contained the original request. The request is not forwarded to any other system. In this case, transport is fine, and is not ...


7

If you know what you're doing, using WCF isn't difficult. If you know what you're doing, using WCF with an STS isn't terribly difficult. If you don't know what you're doing it's all terribly difficult. Who am I kidding, it's WCF, so it's all difficult. :) Generally speaking your architecture falls into the federated trust category, as you're using the STS ...


5

The claim is that "transport mode" security is insecure: "Transport mode is the least secure option and should be avoided." I would say that you are misreading the document. It doesn't say that transport mode is insecure; it says that it's the least secure option—and, implicitly, among the set of options it's talking about. You should not ...


3

Sure, you could scan the MSIL for code that calls into the reflection bits, but there really isn't much that can be done at runtime unless you are monitoring the call stack on each request.


3

The procedure looks fine but you have to decide of a format for the encryption of the PKCS#12 file with the asymmetric key which was generated at step 4. This is not as easy as it seems and you'd better stick to a standard format. At that point, notice that PKCS#12 has an inherent ability to do symmetric encryption, normally with a "password" but the ...


3

This is an accepted method. For example, SecureWorks issues client certs over SSL following a registration process. The risks profile is mostly as follows: Ensuring registration can't be performed by someone other than the intended party; this is generic with other registration processes, and can be the largest risk to address. The transfer of the key via ...


3

Assuming all your accounts are stored in Active Directory, and only AD, and you will not accept any account registered at an external provider, it's hard to see additional benefit of simply using OAuth solely as the protocol to authenticate* users registered on your AD. OAuth has a different use-case, it is designed to fit for federation scenarios: ...


2

A key distinction is whether you want (1) to prevent unauthorized users from accessing this API, (2) to prevent eavesdropping or a man-in-the-middle attack, or (3) to prevent unathorized software being used by an authorized user. For (2) you can use SSL. For (1) you can use SSL and have users authenticate using a password. For (3) there is no reliable ...


2

Not all JSON data is part of the URL's query string. Usually, this is only the case when sending HTTP GET requests to the server. Services like yours are effectively secured by using HTTPS. The underlying TLS protocol encrypts all data exchanged between client and server, even URL query strings. If you configure your WCF service(s) to only expose a HTTPS ...


2

In a word: yes. All message encryption does is make part of the communication confidential. SSL makes sure you're talking to the right server and makes sure nobody listening in can figure out who you're talking to.


2

SSL and certificates don't actually know what a "domain" is. When a client (e.g. Web browser, or an application which calls a Web service) connects to a SSL server, it will look at the server's certificate (as sent by the server itself) and will accept it only if the certificate contains the intended server name. If the client wants to talk to https://www....


1

Instead of generating a first key-pair in your client (which you seem to discard at after this procedure) and generating another key-pair in the server to produce the certificate, you could: generate a single key-pair in the client, turn its public key into a certification request, send it via HTTPS with the registration info to your issuer service, have ...


1

Quote from your own link: When using a transport like HTTPS, this mode has the advantage of being efficient in its performance and well understood because of its prevalence on the Internet. The disadvantage is that this kind of security is applied separately on each hop in the communication path, making the communication susceptible to a man-in-...


1

The Web Application Proxy uses an authorization token to decide whether or not it sets the EdgeAccessCookie. If you can request the authorization token and put it in the URL of your HTTPRequest, the WAP will let you pass. Code snippets: List<KeyValuePair<string, string>> postData = new List<KeyValuePair<string, string>>(); ...


1

The question seems to assume that late-bound invocation of methods is a security problem. However, I don't think it's obvious that this is in fact the case. Generally speaking, most use of late-bound invocation (also known as reflection) is routine and benign. The question doesn't define the threat model that you are trying to defend against. If you are ...


1

This is actually just one of very many ways to open the door to invocation of "unexpected" code. Static analysis tools like FxCop or NDepend can help find some potential problems, as can penetration testing tools, but definitely not all of them. Restricting the runtime permissions of the code can help but, unless you're running a programme like SDL, you'll ...


Only top voted, non community-wiki answers of a minimum length are eligible