Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

hey guys i have written a small webservice which allows users of a company (lets call it xyz) to login to xyz's website remotely via my iphone app (without ever going on xyz's official website to login)

after logging these users programatically to xyz's website, i can allow my users to do many authenticated tasks xyz offers

since xyz does not offer apis for this i was forced to hijack xyz's login cookies from my webservice to allow users to use all the authenticated features

at no point of time am i saving xyz users username or password and use https for my webservice to ensure safety n security of users

however i have got an email from xyz asking me to shut down my webservice otherwise face legal action. if i do that my users would be very unhappy to loose so many cool features of my iphone app

i wanted to know the best way to host my webservice on some offshore server which has elastic / dynamic ip addresses with completely different patters (so xyz cant block a particular range of ips or even domain names)

i have heard amazon provides elastic ips - can they be used for such scenario

or can someone help me come out with a better solution

webservice is asp.net 3.5 based

share|improve this question

closed as off topic by John Gardeniers, squillman, Avery Payne, Kara Marfia Aug 6 '10 at 18:08

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
So you want us to help you do something that you've already been told to cease on threat of legal action?? No thanks. -1 –  squillman Aug 6 '10 at 12:35
    
its not illegal :-) lets look at it this way - its in a way similar to a twitter client - only difference twitter has official apis where as xyz does not provide any apis... illegal would be to misuse users credentials or hack their passwords –  Raj Aug 6 '10 at 12:37
    
If they are threatening legal action then obviously they think that you are violating their terms and that is illegal. –  squillman Aug 6 '10 at 12:51
    
have you not asked them to produce an API? –  JamesK Aug 6 '10 at 12:52
    
Have you just tried asking them nicely for an API? Or even talking with them before embarking on what is sure to cause all kinds of useless drama? Amazing what you can do with honey instead of vinegar.... –  Avery Payne Aug 6 '10 at 17:27

1 Answer 1

Let me see if I have this right. You built an app that not only sits in the middle of an authenticated connection, but authorizes the connection also? Sounds to me like a keylogger. Then you're asking us how to circumvent the law?

illegal would be to misuse users credentials or hack their passwords

So based on you just saying that you're not misusing peoples passwords, they should believe you? And on top of having their userids and passwords, you'll have everything they type into your app (including "authenticated tasks") on your end. You don't have XYZs permissions to be a middle-man, so stop. What you're doing is not only unethical, it's illegal...

I'm willing to bet that most of us Sys Admins spend a lot of time and effort making sure our companies FOLLOW the law. While I'm also sure a good deal of us spend time "hacking" in order to learn, I don't believe that you're asking the right group of folks to help you out.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.