I've read that SSL is a good solution for "point to point" security, and not "end to end" security. For example, in this article at JavaWorld, it says:
SSL/TLS is simply not designed for such a scenario; SSL/TLS only handles point-to-point security... SSL/TLS may secure the path between any two [intermediaries], but not from one end to the other.
I am building a web service to provide data to separate clients, as described in this Programmers.SE question. My understanding of implementing SSL in that context is that I could add some kind of API key to all my web service calls and force HTTPS-only on the service, and I'm as secure as I need to be (I'm not passing anything user-specific, other than an email address under certain circumstances which are made clear to and initiated by the user). But this statement and this article seems to be disputing that. Is it suggesting that a man-in-the-middle attack is still possible on an SSL connection? The OAuth guide states here (second paragraph under "Beyond basic") that:
HTTPS is the recommended solution to prevent a man-in-the-middle attack (MITM), eavesdropping, and other security risks.
How is this reconciled?