3 ms·
TLS client authentication (which I think is what you're getting at) is a pain in the ass to implement clients for properly - OpenSSL is dreadful to use, and for
by vertex-four 10y ago
TLS client authentication (which I think is what you're getting at) is a pain in the ass to implement clients for properly - OpenSSL is dreadful to use, and for many HTTP client libraries you'll need to use it (or a very thin wrapper) to set X.509 client certs, if you even can. On the other hand, there's decent libraries and plenty of information on how to generate and verify an HMAC, and avoid replay attacks.
- jessaustin 10y agoNo that's not what I'm getting at. I'm saying the design of secure protocols is best left for smart people. Every time you post on HN, you're using cookie auth, but you don't have to worry about replay attacks because everything runs inside TLS. Any environment that has HMAC libraries also has the libraries one would need to do the right thing.
- nitrogen 10y agoHMAC is useful for expiring, limited-use tokens without having to store every single token, just the base key. It's used by CloudFront, for example.
- jessaustin 10y agoOh definitely, just pointing out that TLS client certs are used only rarely.