>Anyone here has a working system using Mere Mortals framework web service remote data access? How do you handle security? What's stopping a hacker to hit the asmx page and submit a FillDataSet request?

I set my stuff up to require a username / password for each web method and used the authentication classes to do validation first. You could also just create a session once they've authenticated if you don't want to require it on each hit/web method call.