3

3

I would like to use the bugzscout api, but it can't attach files. The XML API requires a login. Unfortunately we're working with a program that is a target for people to sniff the protocol it uses and we have issues with people reverse engineering the communications and we're worried with people getting the logon details of a FB user for our FB server.

Is this an issue, or is the protocol over https or something?

We assume that we'd create a user account that is just for field submissions - there is no real user associated with it.

Are we missing something? Is there a preferred way to do this?

Is it as simple as setting the url to https?

Right now we are using http. I just found two questions on this site with ansers (one for linux and one MS) for how to configure FB for https. Maybe this is the answer. In that case, what is the suggested way to send xml via ssl in C++?

EDITING this so that it gets bumped up.

This is still a concern for us.

By the way, does the latest hosted FB version support the old bugscout?

flag

3 Answers

1

A solution is to write a web service that uses the XML API to create cases. You should host this web service on an Internet-accessible web server located at your company. The FogBugz username/password would be part of the web service, so that you don't have to give them out to the world. Your application would then connect to your web service to create a FogBugz case, instead of connecting directly to FogBugz.

The downside is that this is going to take a bit of development effort on your part, but in my opinion it's really the only viable option.

link|flag
I guess that will work but it seems like a pain in the neck to solve something that FB should handle int he first place. – Tim Dec 20 2010 at 22:12
1

As long as you are posting over SSL (an https url) your username and password cannot be sniffed on the wire. However, it might still be possible to reverse engineer your executable and possibly pull the username and password from there.

One alternative might be to use a token instead of a username/password combination. See this post.

link|flag
In most cases, using SSL will not help, because it's easy for a hacker to trace SSL traffic from your application. For example, they could just debug the program and set breakpoints at the appropriate network API calls. Or, if you use OpenSSL DLLs, they can just replace your DLLs with OpenSSL DLLs that log all traffic to a file. You'd have to do something like statically link with OpenSSL and then use an EXE protector/encryptor to make life harder for the hacker. – danielm Dec 13 2010 at 20:10
1

This is a critical question for us as well. Since our application will be around for at least 5 years in the field:

a) I'm concerned about using up a licensed user that must permanently keep the same username/password

b) Sending the username/password in cleartext is a problem since it gives a login to our Fogbugz server to the world from everyone who uses our software.

link|flag

Your Answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.