WCF Security - protecting from Man in the middle attacks

Question

I have a WCF service that uses transport and message security. How do i protect data from a malicious man-in-the-middle attack, say from a user using fiddler and allowing fiddler to Decrypt HTTPS traffic?

Answer 1

This topic has been covered in the Fiddler documentation. You can use Fiddler to sniff messages from the parties you have physical access to. Given you don't give physical access to malicious user you are protected with transport and message security.

Q: Does Fiddler2 demonstrate a flaw in HTTPS?

A: No. HTTPS relies on certificates in order to secure web traffic. Web browsers prevent man-in-the-middle attacks by relying upon Trusted Root Certification authorities to issue certificates that secure the traffic. As designed, web browsers will show a warning when traffic is not protected by a certificate issued by a trusted root.

Edit
This is from another relevant answer

Transport security provides only point-to-point channel security. It means that HTTPS establish secure channel only between client and server exposed to client. But if this server is just a load balancer or proxy server it has direct access to content of the message.

Message security provides end-to-end channel security. It means that security is part of transferred data and only intended destination can decrypt the data (load balancer or proxy sees only encrypted message). Message security in most cases also uses certificates to provide encryption and signing but it is usually slower because transport security can use HW acceleration.