4 ms·
From a cursory glance that version while better, looks vulnerable to replay attacks since I don't see any mention of timestamps or MAC Of course this requires
by no_time 5y ago
From a cursory glance that version while better, looks vulnerable to replay attacks since I don't see any mention of timestamps or MAC
Of course this requires the attacker to purchase at least one license so its a partial victory :^)
- ezekg 5y agoThe response body itself for key requests, such as for license validations, contains a timestamp to prevent replay attacks. You can also send nonces, which will be echoed back. :) But it is worth mentioning -- I am working on improving the request signature header to include more info such as current token and date. Just need to finish some other stuff on the roadmap first.