7 ms·

Many apps do not require account registration, so then what? I guess it could generate a server-side API token on first login then persist it. But then you need

Many apps do not require account registration, so then what? I guess it could generate a server-side API token on first login then persist it. But then you need an API, which adds unnecessary cost.

tokenizerrr 10y ago
Unnecessary cost? It's the cost of preventing hackers from being able to spin up 100s of EC2 instances using your account. Make your own damn API. Have it do exactly what users are allowed to do on your behalf. It's not an unnecessary cost, it is 100% necessary if you are interfacing with external services from your app. Or don't, and get bitten in the ass eventually.
- bottled_poe 10y ago
  That EC2 example is a bit extreme, but in general I agree with what you are saying. Unfortunately, the reality is that most people paying for software development are more willing to accept these risks than to pay for security. That said, security is not all-or-nothing. And anyone who believes that modern web-connected software can be 100% secure is either misinformed or trying to sell you something that you probably don't need.
  - BoorishBears 10y ago
    If instead of exposing your API keys you implement an API that proxies that responsibilities your app would have needed those keys for, how are your API keys not 100% secure? You even get the added benefit of separating the implementation of those responsibilities from your app (and with app update processes being what they are, that's a huge deal when you need to make an emergency change to how you're using those APIs)
BoorishBears 10y ago
Amazon Congito already provides it for both registered and unregistered users: https://aws.amazon.com/blogs/mobile/using-the-amazon-cognito-credentials-provider/ https://aws.amazon.com/blogs/mobile/using-the-amazon-cognito... And they also provide a generic TVM (Token Vending Machine) implementation that you could adapt for other APIs

Many apps do not require account registration, so then what? I guess it could generate a server-side API token on first login then persist it. But then you need an API, which adds unnecessary cost.

tokenizerrr 10y ago

Unnecessary cost? It's the cost of preventing hackers from being able to spin up 100s of EC2 instances using your account. Make your own damn API. Have it do exactly what users are allowed to do on your behalf. It's not an unnecessary cost, it is 100% necessary if you are interfacing with external services from your app. Or don't, and get bitten in the ass eventually.

bottled_poe 10y ago
That EC2 example is a bit extreme, but in general I agree with what you are saying. Unfortunately, the reality is that most people paying for software development are more willing to accept these risks than to pay for security. That said, security is not all-or-nothing. And anyone who believes that modern web-connected software can be 100% secure is either misinformed or trying to sell you something that you probably don't need.
- BoorishBears 10y ago
  If instead of exposing your API keys you implement an API that proxies that responsibilities your app would have needed those keys for, how are your API keys not 100% secure? You even get the added benefit of separating the implementation of those responsibilities from your app (and with app update processes being what they are, that's a huge deal when you need to make an emergency change to how you're using those APIs)

BoorishBears 10y ago

Amazon Congito already provides it for both registered and unregistered users: https://aws.amazon.com/blogs/mobile/using-the-amazon-cognito-credentials-provider/ https://aws.amazon.com/blogs/mobile/using-the-amazon-cognito... And they also provide a generic TVM (Token Vending Machine) implementation that you could adapt for other APIs