Web Service Security question

[blue_nirvana]

I have a wireless device that is not attached to the domain. So I created a
Web Service that I pass the UserName and Password to see if it is a valid
user using the LogonUser API. I have the WebService site set to use Anomyous
access. This is all done on our Intranet. I was thinking that I needed to
set it up to use SSL to encrypt the UserName and Password.

I'm fairly new to security with Web Services and was wondering if this was
approiate way or if I should be doing this a different way? What security
issues should I need to address seeing how this is on a local intranet and
also considering it is a wireless device? I definitely do not want to be
sending UserName and Passwords as plain text over our wireless network. Any
links or input is appreciated.

Thanks

[Martin Kulov]

"blue_nirvana" <bl*********@discussions.microsoft.com> wrote in message
news:FD**********************************@microsof t.com...

What security issues should I need to address seeing how this is on a
local intranet and
also considering it is a wireless device? I definitely do not want to be
sending UserName and Passwords as plain text over our wireless network.
Any
links or input is appreciated.

Hi,

you can use WSE [1] with "Username over Certificate" turnkey scenario to
protect your web service. Sending plaintext passwords over wireless network
is definitely not a good idea.

[1] http://msdn.microsoft.com/webservice.../building/wse/

Best,

--
Martin Kulov
http://www.codeattest.com/blogs/martin

MCAD Charter Member
MCSD.NET Early Achiever
MCSD