4 ms·
You can use request signatures to combat MITM attacks quite easily. Certificate pinning is not really needed. All requests are signed the same way license keys
by ezekg 5y ago
You can use request signatures to combat MITM attacks quite easily. Certificate pinning is not really needed. All requests are signed the same way license keys are, so without a crack to change the embedded public key, forging a request is essentially impossible.
That particular C++ example does not include signature verification, but there is another example repo [0] for that.
[0]: https://github.com/keygen-sh/example-cpp-request-signature-verification https://github.com/keygen-sh/example-cpp-request-signature-v...
- no_time 5y agoFrom a cursory glance that version while better, looks vulnerable to replay attacks since I don't see any mention of timestamps or MAC Of course this requires the attacker to purchase at least one license so its a partial victory :^)
- ezekg 5y agoThe response body itself for key requests, such as for license validations, contains a timestamp to prevent replay attacks. You can also send nonces, which will be echoed back. :) But it is worth mentioning -- I am working on improving the request signature header to include more info such as current token and date. Just need to finish some other stuff on the roadmap first.