Navigation

Search

Categories

On this page

WSE and the Next Generation of Security

Archive

Blogroll

Disclaimer
The opinions expressed herein are my own personal opinions and do not represent my employer's view in any way.

RSS 2.0 | Atom 1.0 | CDF

Send mail to the author(s) E-mail

Total Posts: 83
This Year: 0
This Month: 0
This Week: 0
Comments: 5

Sign In

# Wednesday, December 31, 2003
WSE and the Next Generation of Security
Wednesday, December 31, 2003 1:38:20 AM UTC ( Security | WSE )

I have spent a lot time with WSE 2.0 in the last few weeks, and as both my code and my mindset moves from testing and research to building production quality systems, I am beginning to think about how hard it is to get the security choices right with WSE 2.0.

From a practical point of view, the move from plain ASP.NET Web Services to WSE and WS-Security is about moving from the SSL checkbox in IIS to a fairly imperative and challenging programming model in WSE 2.0. While the SSL-checkbox is inflexible and does not provide you with a lot of room for configuration, it is reasonably simple to get right. The WSE toolkit on the other hand provides you with a lot of room for mistakes and bad decisions. Throw a bit of WS-SecureConversation and WS-Trust into the mix and things really start to get interesting.

Even though WSE is an advanced toolkit for early adopters, it is still being marketed and generally perceived as the technology that will ensure secure web services. In the real world, it needs to be easy to build secure services. This is not because security is a simple concept to grasp, as it in fact is hugely complex, but because it is a basic requirement in any software project. We need to be practical and provide solutions that by default are as close to bulletproof as we can get them.

Looking at the samples in the WSE 2.0 TP distribution, I fail to find one that ensures integrity and confidentially for both the request and the response in a message exchange, but I have not done an exhaustive search. Given the affection that exists for copy and paste development, I am scared of what will travel from and to web services in the next couple of years.

I know that making the move to WSE is about a lot more than just migrating from SSL/ TLS to the WS-x family, but I think that it will be one of the most common scenarios.

My current thinking is that I would not recommend using WSE unless you have a very strong understanding of security and you have a dire need for the functionality it provides.

This entry seems a bit negative towards WSE, but I assure you that it is a great toolkit with a lot of good stuff in it. My concern is with whether or not the migration from SSL checkbox security to WSE-security is an evolution that will increase security or be a great source for error and confusion. Simple end-to-end samples together with practical prescriptive guidance may be a viable path towards solving this problem.

I am just in the beginning of forming my opinions on this topic; perhaps they will change.

Comments [0] | | # 
Related posts:
DEP is useless?
MD5-signed X.509 certificates in trouble
Tired of all the UAC prompts?
WCF Compression Filter
WSE: Another Compression Filters Update!
WS-Addressing makes its way to W3C
Tracked by:
"http://tomber.xhost.ro" (http://tomber.xhost.ro) [Pingback]
"http://freewebs.com/lcddlp/04/sitemap12.html" (http://freewebs.com/lcddlp/04/si... [Pingback]
"http://pi459420.qbigvm1.info/sitemap16.html" (http://pi459420.qbigvm1.info/site... [Pingback]
"http://ky855983.soll6dp.info/sitemap2.html" (http://ky855983.soll6dp.info/sitem... [Pingback]
"http://realestate.hr/templates/css/pages/13223573/index.html" (http://realestat... [Pingback]
"http://temerav.com/images/menu/74267147/cialis-injury-lawyer-columbus.html" (ht... [Pingback]
"http://plantmol.com/pages/54816534/slapped-girl-him-giggle.html" (http://plantm... [Pingback]
"http://vladan.strigo.net/wp-includes/js/pages/79014369/busty-blonde-samantha-in... [Pingback]
"http://pddownloads.com/pages/40355407/free-sample-viagra-womens.html" (http://p... [Pingback]
"http://split-dalmatia.com/split-dalmatia.com/images/pages/81160650/cialis-sa.ht... [Pingback]
"http://pspdesktops.com/fileupload/store/pages/09729971/cheapest-viagra-in-uk-ch... [Pingback]
"http://allfreefilms.com/wp-includes/js/29547492/ff11-player-pics.html" (http://... [Pingback]
"http://witze-humor.de/templates/images/pages/templates/images/pages/14611263/fr... [Pingback]
"http://pspdesktops.com/fileupload/store/pages/30796205/jodie-marsh-sex-vids.htm... [Pingback]
"http://ipsilon.hr/ipsilon.hr/cms/4/lib/pages/11229479/index.html" (http://ipsil... [Pingback]
"http://realestate.hr/templates/css/pages/13223573/dad-and-sister-xxx.html" (htt... [Pingback]
"http://legambitdufou.org/Library/pages/91955120/female-sexual-inhancer-viagra-s... [Pingback]
"http://pspdesktops.com/fileupload/store/pages/97645285/viagra-jelly.html" (http... [Pingback]
"http://discussgod.com/cpstyles/pages/24444633/kevin-harvick-viagra.html" (http:... [Pingback]
"http://pddownloads.com/pages/99273746/index.html" (http://pddownloads.com/pages... [Pingback]
"http://ncdtnanotechportal.info/generator/pages/72221601/thailand-buy-viagra.htm... [Pingback]
"http://allfreefilms.com/wp-includes/js/69969937/what-pharmaceutical-company-mak... [Pingback]
"http://jivest2006.com/pages/32403550/acheter-du-viagra.html" (http://jivest2006... [Pingback]
"http://swellhead.net/89989421/netflix-of-anime.html" (http://swellhead.net/8998... [Pingback]
"http://ipsilon.hr/ipsilon.hr/cms/4/lib/pages/29336514/cheapest-cialis-generic.h... [Pingback]
"http://hrvatska.biz/wp-includes/js/pages/72590233/10-stories.html" (http://hrva... [Pingback]
"http://discussgod.com/cpstyles/pages/55285889/compare-viagra-to-cialis.html" (h... [Pingback]
"http://thejohnslater.com/pix/img/pages/19727212/100-mg-viagra-dangerous.html" (... [Pingback]
"http://lecouac.org/ecrire/lang/pages/67575340/buying-viagra.html" (http://lecou... [Pingback]
"http://swellhead.net/10430138/cialis-au.html" (http://swellhead.net/10430138/ci... [Pingback]
"http://allfreefilms.com/wp-includes/js/69969937/what-works-better-levitra-viagr... [Pingback]
"http://realestate.hr/templates/css/pages/80313824/lolita-tales.html" (http://re... [Pingback]
"http://realestate.hr/templates/css/pages/89713679/sex-offender-lists-new-york.h... [Pingback]
"http://temerav.com/images/menu/74267147/index.html" (http://temerav.com/images/... [Pingback]
"http://ncdtnanotechportal.info/generator/pages/88274118/on-line-viagra.html" (h... [Pingback]
"http://lbxaveg.net/00/index.html" (http://lbxaveg.net/00/index.html) [Pingback]
"http://promocija.com.hr/promocija.com.hr/includes/js/docs/70471394/index.html" ... [Pingback]
"http://islands-croatia.comislands-croatia.com/includes/js/docs/54089144/index.h... [Pingback]
"http://martinrozon.com/images/photos/docs/61904307/index.html" (http://martinro... [Pingback]
"http://discussgod.com/cpstyles/docs/73291253/index.html" (http://discussgod.com... [Pingback]
"http://swellhead.netswellhead.net/docs/05235252/index.html" (http://swellhead.n... [Pingback]
"http://add2rss.com/img/design/docs/90861918/index.html" (http://add2rss.com/img... [Pingback]
"http://promocija.com.hr/promocija.com.hr/includes/js/docs/48335156/index.html" ... [Pingback]
"http://thejohnslater.com/pix/img/docs/56008043/index.html" (http://thejohnslate... [Pingback]
"http://legambitdufou.org/Library/docs/64933533/index.html" (http://legambitdufo... [Pingback]
"http://ipsilon.hr/ipsilon.hr/cms/4/lib/docs/24066563/index.html" (http://ipsilo... [Pingback]
"http://swellhead.netswellhead.net/docs/42306518/index.html" (http://swellhead.n... [Pingback]
"http://pddownloads.com/docs/94929363/index.html" (http://pddownloads.com/docs/9... [Pingback]
"http://entartistes.ca/images/images/docs/65934120/index.html" (http://entartist... [Pingback]
"http://split-dalmatia.com/split-dalmatia.com/images/docs/34320152/index.html" (... [Pingback]
"http://slaterjohn.com/downloads/2col/51579700/index.html" (http://slaterjohn.co... [Pingback]
"http://promocija.com.hr/promocija.com.hr/includes/js/docs/36483653/index.html" ... [Pingback]
"http://lecouac.org/ecrire/lang/docs/20007231/index.html" (http://lecouac.org/ec... [Pingback]
"http://temerav.com/images/menu/20420171/index.html" (http://temerav.com/images/... [Pingback]
"http://ncdtnanotechportal.info/generator/docs/13227634/index.html" (http://ncdt... [Pingback]
"http://temerav.com/images/menu/05559064/index.html" (http://temerav.com/images/... [Pingback]
"http://thebix.com/includes/compat/docs/15132509/index.html" (http://thebix.com/... [Pingback]
"http://thejohnslater.com/pix/img/docs/86193101/index.html" (http://thejohnslate... [Pingback]
"http://allfreefilms.com/wp-includes/js/46226552/index.html" (http://allfreefilm... [Pingback]
"http://lecouac.org/ecrire/lang/docs/49649526/index.html" (http://lecouac.org/ec... [Pingback]
"http://legambitdufou.org/Library/docs/15090396/index.html" (http://legambitdufo... [Pingback]
"http://allfreefilms.com/wp-includes/js/27702077/index.html" (http://allfreefilm... [Pingback]
"http://ncdtnanotechportal.info/generator/docs/87198700/index.html" (http://ncdt... [Pingback]
"http://martinrozon.com/images/photos/docs/82037625/index.html" (http://martinro... [Pingback]
"http://islands-croatia.comislands-croatia.com/includes/js/docs/06712704/index.h... [Pingback]
"http://legambitdufou.org/Library/docs/38152786/index.html" (http://legambitdufo... [Pingback]
"http://islands-croatia.comislands-croatia.com/includes/js/docs/82710340/index.h... [Pingback]
"http://martinrozon.com/images/photos/docs/75270452/index.html" (http://martinro... [Pingback]
"http://pddownloads.com/docs/08296030/index.html" (http://pddownloads.com/docs/0... [Pingback]
"http://jivest2006.com/docs/40579018/index.html" (http://jivest2006.com/docs/405... [Pingback]
"http://discussgod.com/cpstyles/docs/43932298/index.html" (http://discussgod.com... [Pingback]
"http://discussgod.com/cpstyles/docs/25383456/index.html" (http://discussgod.com... [Pingback]
"http://vladan.strigo.net/wp-includes/js/docs/25746442/index.html" (http://vlada... [Pingback]
"http://vladan.strigo.net/wp-includes/js/docs/09763218/index.html" (http://vlada... [Pingback]
"http://pddownloads.com/docs/21991908/index.html" (http://pddownloads.com/docs/2... [Pingback]
"http://pspdesktops.com/fileupload/store/docs/18769945/index.html" (http://pspde... [Pingback]
"http://sevainc.com/bad_denise/img/11/ultram/" (http://sevainc.com/bad_denise/im... [Pingback]
"http://sevainc.com/bad_denise/img/2/cialis/" (http://sevainc.com/bad_denise/img... [Pingback]
"http://birds.sk/img/cialis/" (http://birds.sk/img/cialis/) [Pingback]
"http://sevainc.com/bad_denise/img/8/paxil/" (http://sevainc.com/bad_denise/img/... [Pingback]
"http://sevainc.com/bad_denise/img/6/lipitor/" (http://sevainc.com/bad_denise/im... [Pingback]
"http://jemnemelodierecords.sk/img/viagra/" (http://jemnemelodierecords.sk/img/v... [Pingback]
"http://sevainc.com/bad_denise/img/5/effexor/" (http://sevainc.com/bad_denise/im... [Pingback]
"http://sevainc.com/bad_denise/img/11/tramadol/" (http://sevainc.com/bad_denise/... [Pingback]
"http://birds.sk/img/viagra/" (http://birds.sk/img/viagra/) [Pingback]
"http://sevainc.com/bad_denise/img/12/zoloft/" (http://sevainc.com/bad_denise/im... [Pingback]
"http://adventure-traveling.com/images/img/viagra/" (http://adventure-traveling.... [Pingback]
"http://inatelevizia.sk/ad/img/cialis/" (http://inatelevizia.sk/ad/img/cialis/) [Pingback]
"http://simplecanada.info/js/pages/13912893/" (http://simplecanada.info/js/pages... [Pingback]
"http://sevainc.com/bad_denise/img/7/melatonin/" (http://sevainc.com/bad_denise/... [Pingback]
"http://sevainc.com/bad_denise/img/3/clomid/" (http://sevainc.com/bad_denise/img... [Pingback]
"http://sevainc.com/bad_denise/img/7/nexium/" (http://sevainc.com/bad_denise/img... [Pingback]
"http://abaffydesign.com/la/img/cialis/" (http://abaffydesign.com/la/img/cialis/... [Pingback]
"http://inatelevizia.sk/ad/img/viagra/" (http://inatelevizia.sk/ad/img/viagra/) [Pingback]
"http://sevainc.com/bad_denise/img/10/soma/" (http://sevainc.com/bad_denise/img/... [Pingback]
"http://rogents.netfirms.com" (http://rogents.netfirms.com) [Pingback]
"http://ayavqoc.net/sitemap1.html" (http://ayavqoc.net/sitemap1.html) [Pingback]
"http://restablog.dreamhosters.com/garage/sitemap1.html" (http://restablog.dream... [Pingback]
"http://host239.hostmonster.com/~blogford/sitemap1.html" (http://host239.hostmon... [Pingback]
"http://lgicsge.net/gift/sitemap1.html" (http://lgicsge.net/gift/sitemap1.html) [Pingback]
"http://blogfordummies.org/sitemap1.html" (http://blogfordummies.org/sitemap1.ht... [Pingback]
"http://box432.bluehost.com/~zbloginf/sitemap1.html" (http://box432.bluehost.com... [Pingback]
"http://gator442.hostgator.com/~hockteam/windows/sitemap1.html" (http://gator442... [Pingback]
"http://host256.hostmonster.com/~alldomai/sitemap3.html" (http://host256.hostmon... [Pingback]
"http://me7mesi.net/sitemap1.html" (http://me7mesi.net/sitemap1.html) [Pingback]
"http://negator.startlogic.com/sitemap2.html" (http://negator.startlogic.com/sit... [Pingback]
"http://dl5czga.info/sitemap1.html" (http://dl5czga.info/sitemap1.html) [Pingback]
"http://freewebs.com/sinkopa/02/sitemap1.html" (http://freewebs.com/sinkopa/02/s... [Pingback]
"http://sinkopa.webs.com/01/sitemap4.html" (http://sinkopa.webs.com/01/sitemap4.... [Pingback]
"http://host264.hostmonster.com/~battery1/sitemap1.html" (http://host264.hostmon... [Pingback]
"http://nejolan.homestead.com/05/marple-newtown-school-district.html" (http://ne... [Pingback]
"http://dolopat.homestead.com/07/calvino.html" (http://dolopat.homestead.com/07/... [Pingback]
"http://loptuner.homestead.com/05/animal-kingdom.html" (http://loptuner.homestea... [Pingback]
"http://nejolan.homestead.com/02/what-is-a-prime-number.html" (http://nejolan.ho... [Pingback]