CodeAttest
VSTS, Oslo, INETA, ASP.NET, Debugging .NET Applications, Tips and Tricks

January 18, 2005

WSE send encrypted password

William Stacey points out one major problem when using SendHashed and SendNone options. They are both vulnerable to dictionary attack. As he offers to present a solution using custom UsernameTokenManager and Crypto API, I would recommend that you implement SecureConversation and use option SendPlainText. This way your calls can be automatically authorized depending on their group membership. The only drawback is that you must have server certificate, but you can always generate one with makecert.exe util.

# posted by Martin Kulov @ 7:24 PM




This page is powered by Blogger. Isn't yours?

 




Calendar Martin Kulov's Calendar   RSS Aggregate this blog

DevReach - The Premier Conference for Microsoft Technologies for SEE

Mobility Day 2008 Conference

DevReach - The Premier Conference for Microsoft Technologies in Bulgaria

International Association of Software Architects

SofiaDev .NET User Group

Microsoft Most Valuable Professional

View Martin Kulov's profile on LinkedIn

MSDN Event Bloggers




Recent posts




History




 
Copyright © 2004-2008 CodeAttest Ltd. All Rights Reserved.