Is Transport Level Security Necessary When Using Message Level Security in WCF?

Question

I\'m still in the process of trying to better understand WCF security.

One question that I can\'t seem to get a grip on is… if message level security is used, then

Answer 1

If you use message-level security in the form of encryption, then you should not need to also use transport-level encryption. However, doing so will certainly make your message more secure. If you only use message-level security to sign outgoing messages, then you will also want to use transport-level security if your message contains sensitive information.

It is important to use transport-level security when no message-level encryption is used. In fact, WCF requires you to use SSL when using UsernameToken plaintext, for example.