Re^2: A question about web service security

Replies are listed 'Best First'.
Re^3: A question about web service security by thenaz (Beadle) on Aug 05, 2011 at 13:23 UTC
Actually no. You can use a challenge/response technique. Take the MD5 hash of the current time plus some secret "seed", and send that to the client. Then, whenever the client requests that action, it must supply this MD5 hash. On the server side, you recalculate the hash for each of the last x seconds, and see if any matches what the client supplied. Only permit the action if the hash matches. The trick is to only deliver a hash to the client when it is a valid time to perform the action. And by restricting x to a small number of seconds, you control fairly tightly when the action can take place. So even if they do fake it, they can only fake it when it's a valid time to perform the action anyway.	[reply]
Re^4: A question about web service security by PerlOnTheWay (Monk) on Aug 05, 2011 at 14:10 UTC
Whatever seed you choose,you need to send it to the client, and a programmer can do faking using that seed...	[reply]
Re^5: A question about web service security by Anonymous Monk on Aug 05, 2011 at 14:26 UTC
This is how public key ecryption works. The server has private key, it doesn't share it. The client gets servers public key (everybody gets public key). you encrypt messaages for server using public key, only server can read them server uses private key to decrypt message encrypted with public key. Only server has private key.	[reply]
Re^6: A question about web service security by PerlOnTheWay (Monk) on Aug 05, 2011 at 15:02 UTC
Re^7: A question about web service security by Anonymous Monk on Aug 05, 2011 at 16:08 UTC
Re^3: A question about web service security by Anonymous Monk on Aug 05, 2011 at 13:35 UTC
However you expose it, it always can be faked IMO... Um, the solution is to NOT expose it If its private data, only the server is supposed to modify, the solution is to only let the server modify it I think you need to explain the architecture of your application, draw a plain ASCII diagram or flowchart Think of the server as a bartender, who needs to check id, serve drinks, make change ... only bartender touches the cash register, customers always have to go through bartender, and he knows how to spot fake currency, fake ids, how much vodka is left ... bartender is gatekeeper See The Architecture of Open Source Applications	[reply]
Re^4: A question about web service security by PerlOnTheWay (Monk) on Aug 05, 2011 at 14:04 UTC
Don't you guys ever play web games?? It's impractical to send a request to the server side whenever you move/click your mouth....That will no doubt cause performance issue and no one will like to play your game...	[reply]
Re^5: A question about web service security by Anonymous Monk on Aug 05, 2011 at 14:28 UTC
Don't you guys ever play web games?? Just how do you think web games work? They still have to authenticate users, validate moves ...	[reply]