Hi Tim,

Thanks for the post about these. I'm specifically interested in security issues around Silverlight clients at present as we're looking at developing a LOB application using Silverlight in out presentation layer. The "Security Guidance for Writing and Deploying Silverlight Applications" document is very useful in terms of info on XSS, browser sandbox, cross domain calls etc. and I know we'll be referring to it.

However, what I'm really looking for at the moment is guidance and best practice around security issues with the communication between a Silverlight client and WCF web services on the back end. Because Silverlight only supports basicHTTPBinding, and not wsHttpBinding, and only transport security and not message security, it seems we may have to write a whole bunch of stuff to replicate the WS-* standards built into wsHttpBinding (WS-Security, WS-ReliableMessaging).

I have two questions really:

1) Are you going to introduce wsHttpBinding capability into Silverlight? ( you probably can't/won't answer that one at present I guess :) )

2) Do you know of any guidance anywhere that might help us come up with a custom solution on the Silverlight end to provide message security, protection against replay attacks etc?

Cheers,
Greg

Thanks for your feedback Tim. I think I'm going to wait for MIX 09 and see if there are any bones for us serious LOB developers before making any decisions on our security.