wcf - How to authenticate an application, instead of a user? -

-

in context of wcf/web services/ws-trust federated security, accepted ways authenticate application, rather user? gather, seems certificate authentication way go, ie generate certificate application. on right track here? there other alternatives consider?

what trying solve general digital rights management problem, unsolved problem @ moment.

there whole host of options remote attestation involve trying hide secrets of sort (traditional secret keys, or semi-secret behavioural characteristics).

some simple examples might deter casual users of api working around it:

  • include &officialclient=yes in request
  • include &appkey=<some big random key> in request
  • store secret app , use simple challenge/response: send random nonce app , app returns hmac(secret,nonce))

in general 'defenders advantage' quite small - effort put in try , authenticate bit of software talking in fact software, isn't going take attacker/user more effort emulate it. (to break third example gave, don't need reverse engineer official client - user can hook official client answer challenges own client receives.)

the more robust avenue can pursue licencing / legal options. famous example twitter, prevent knocking old client through api licence terms , conditions - if created own (popular) client pretended twitter api official twitter client, assumption lawyers come a-knocking.


Comments

Post a Comment

Popular posts from this blog

java - JavaFX 2 slider labelFormatter not being used -

-
i have following code not label slider "foo50", etc... 1 expect setlabelformatter call, instead seems have no effect (the slider labelled 50, 100, etc , println's dont run). there missing? not implemented in default 2.2 skin? using oracle java 7 package javafxbugtest; import javafx.application.application; import javafx.scene.*; import javafx.scene.control.*; import javafx.stage.*; import javafx.util.stringconverter; public class javafxbugtest extends application { @override public void start(final stage primarystage) { slider cp = new slider(); cp.setlabelformatter(new stringconverter<double>() { @override public string tostring(double t) { system.out.println("nope?"); return "foo" + t.tostring(); } @override public double fromstring(string string) { system.out.println("he
Read more

Detect support for Shoutcast ICY MP3 without navigator.userAgent in Firefox? -

-
the current version of mozilla firefox 23.0.1, version not support play mp3 shoutcast streams tcp port different 80 (most common 8000 shoutcast 1.9.8). i use flash when mp3 support not available in html5 audio, way detect is: try{ var = document.createelement('audio'); r = !!(a.canplaytype && !!a.canplaytype("audio/mpeg; codecs=mp3").replace(/^no$/,'')) }catch(e){ r = false; } the support mp3 shoutcast streams in firefox added in version 24 . a.canplaytype("audio/mpeg; codecs=mp3") = in chrome , firefox, chrome support, firefox not support, due current code detect not work firefox. the current version of jquery support ie 6 1.10.2, version not has .browser i think "stylized" way testing features , not querying browsers / versions, notwithstanding here see hard not violate "principle". what "stylized" way of detect mp3 icy support without navigator.useragent in firefox? ther
Read more

web - SVG not rendering properly in Firefox -

-
i have problem svg renderring in firefox. whilst works in safari, chrome or in ie, doesn't work in firefox. inspecting element seems layers there, background visible if it's z-index higher z-index of others. rendered in firefox: svg logo in firefox link original source file: svg file thanks help. ps: used sketch 3 export svg. if helps somehow. you're experiencing bug 995813 . i fixed bug time ago change still making way through release process example display correctly firefox 31 onwards released on 22 july 2014. in meantime if move fill="white" <mask> element child <use> element work around firefox bug.
Read more