Attacking XML Security

This document discusses XML security and attacks on web services. It begins with an agenda that covers introducing the speaker and why XML security matters. It then discusses challenges to the conventional wisdom that message-oriented security is better than SSL/TLS, arguing that SSL provides what is needed for most real-world web service deployments while WS-Security is more complex, error-prone, and expands attack surfaces. The document notes that web services are often used internally or for business-to-business interfaces, where accountability discourages malicious behavior more than anonymous internet threats. It concludes SSL is still better than WS-Security for authenticating users and excluding unauthorized attackers.