Hi All,

I now have a client that will expect a secure response to be returned from
the server. To achieve the authentication I have extended
UsernameTokenManager in the standard way (this will be ported to a
certificate-based solution in the near future).

What is troubling me, however, is the App.Config file that ships with the
client app.

1.    Could somebody change the reference to my securityTokenManager to
point to another manager that would supply false positives?
2.    If 1. is not possible, surely they could just delete this file and
then WSE would use that machines Windows Logon routine to validate a
response - which could also be comprosmised!

Am I worrying about nothing?

Chris