CODEWITHSUNDEEP
wcfsecuritysslasp.net-web-apihttps
saransh mehra
saransh mehra

Reputation: 167

I am so confused about Transport level security in WCF vs SSL on Internet

I have read a lot of articles saying that in WCF you have two types of security one is transport level and other is message level. Transport level security must be used when you have intranet connection as it provides point to point security and underlying protocol should be SSL....

But if I search on how to secure public websites they all say use HTTPS(SSL) again SSL.

These two statements are contradictory.

Questions:

  1. What exactly is the meaning of point to point security here?
  2. If SSL is only point to point(and not end to end) then why people use it for public websites?

Upvotes: 1

Views: 146

Answers (1)

Yashveer Singh
Yashveer Singh

Reputation: 1987

HTTPS encrypts data from point-to-point, and once the data reaches one of the points and is decrypted, no security guarantee is made from that point onwards. Intermediary nodes, however, cannot read the information.

Message security, on the other hand, can encrypt data to be decrypted only by a certain recipient, which can be a separate entity from the receiving end. The receiving end might eventually forward the encrypted message to the intended recipient who will be able to decrypt the message.

An analogy would be email. If you establish a connection with your mail server using transport security (e.g. HTTPS), any information is guaranteed to be secured from your machine to the mail server. However, anyone with access to the mail server (e.g. server administrators) will be able to read the content of the email.

On the other hand, if you use message security to encrypt the message so only a specified recipient can decrypt it, the actual email message is encrypted (and not simply the communication between you and the server), so that even once the message is received by the server, it is still encrypted. Only when the email server forwards your message to your intended recipient, the recipient can decrypt the message using his own private key, thereby keeping the email private across a whole path of delivery while not requiring direct communication by the sender and that recipient, as is required by transport-level security.

Of course, some parts of the message must remain visible to the email server, for example the recipients address, and so you may want to use both levels of security: message security will ensure the mail server (or any party except the recipient) can't read the content of your email, and transport security will additionally ensure that a third party listening in to the communications between you and your mail server can't find out who you're sending an email to (unless the mail server divulges that information to that third party

Taken from WCF Transport security weakness

Read more here https://msdn.microsoft.com/en-us/library/hh273109(v=vs.100).aspx

Answer to question 2 :

Because once it reached to the IIS Server which is hosted by the company itself/or in Data center which has all firewalls and other security measures which is hard to bypass which means no one can read your message from that server unless is can hack everywhere it saves oecerhead of tcp security.

Upvotes: 1

Related Questions