title: Secure Communication Between .Net Application and Website
body: <p>Recently, We developed an application that we want it's users to pay for a monthly subscription in order to use it. So the first thing that came to our minds how to implement a secure way for our application to check for the User validity and those ideas came up</p>
  
  <ol>
  <li>Using <code>WebClient</code> to enter to our website and <code>Login</code> using the user
  provided credentials : However, this might be vulnerable to <code>MITM</code>
  attack.</li>
  <li>Using the first approach but using <code>SSL</code> certificate (to make sure
  that we are connecting to our server and not the attackers') :
  However, <code>Fiddler</code> can easily do a <code>MITM</code> attack and decrypt the <code>SSL</code>
  communication, which will result in the same vulnerability as the
  first approach.</li>
  </ol>
  
  <p>Due to the internet's lack of documentation of what we need, we had to ask here for someone to explain how could we make sure that:</p>
  
  <ol>
  <li>Our application <code>only</code> connects to our server and not any fake hosted
  server (by the attacker).</li>
  <li>The communication is secure. Not altered or edited some how in order to
  grand unfair access to our application. (by sending a fake response
  to the app or editing the original response before the application receives it).</li>
  </ol>
  
  <hr>
  
  <p><em><code>Note: we totally understand that the attacker may just deobfuscate the application and do whatever he want to it. So we are planning to get a good</code>obfuscator<code>in order to at least make it harder for the attacker to do so.</code></em></p>