Ever since the concept of "Web services" was defined, there have been questions about their security. Early specifications for Web services paid little attention to security, other than to note that security was going to be an issue someday. Depending on whom you talk to, Web services have either forged ahead without much security or limped along over security worries. In the past few months, many more detailed proposals for Web-services security have emerged. The important questions now, of course, involve not only the efficacy of these proposed systems, but whether anyone will actually use them.