ASP.Net Is my web service secure enough?

Question

I have a web service with several web methods, each web method requires client machine to send their MAC Address and the server will validate this client base on this information (if not valid then return error) before proceeding to further operations. The communication between client and server is HTTPS. I only have about 20 clients or so. The question is is my way of doing this right/secure or not? If not then is there any simple way to do this?

Thanks,

Answer 1

The client can spoof the MAC address of the machines which is authorized. So, this is not secure.

Protecting your webservice through client certificates would provide better security.

Tutorial : http://www.codeproject.com/KB/WCF/9StepsWCF.aspx

Answer 2

No, it's not secure because anyone who knows a valid MAC address in your database could call the web service. Of course knowing a valid MAC address in your database is unlikely possible, it's as if he knew a password.

Answer 3

It depends on your security requirements, there is no one definition of "secure enough". As others have said, the MAC can be spoofed, and is in effect just a shared secret/password. However, that is sufficient for many scenarios, when the confidentality of the connection is ensured by HTTPS. You need to define what threats you want to protect the system from, and how much you're willing to invest in security.