3 ms·

Super interesting! I wonder - have any other services or companies (SaaS or otherwise) adopted SigV4 other than AWS? Seems like a solid protocol (though a lot

Super interesting! I wonder - have any other services or companies (SaaS or otherwise) adopted SigV4 other than AWS? Seems like a solid protocol (though a lot to implement in a client, that can be encapsulated in an SDK)

jaytaylor 5y ago
Is there a benefit to companies all using the exact same web service request signature scheme? One downside is that it would make widespread web service API abuse even easier than it already is. One would need to understand even less about the mechanics and workings of same-scheme services across companies. Yes, this is security through obscurity, but why leave more surface area open than necessary? Malicious actors will certainly appreciate it!
- whartung 5y ago
  > Is there a benefit to companies all using the exact same web service request signature scheme? Well, there's some things to consider. First, Amazon AWS is a very rich target. It hosts a very large quantity of services that would be ripe for exploitation. I'm sure attackers would love to find holes in the AWS mechanism. Second, because of number 1, I'm sure the AWS services are not only a prime target for attack, but also actively being attacked. By both nefarious black hat ne'er do wells, to state level agencies. I would fully expect US, Russian, Chinese and other state intelligence agencies to be very interested in an exploit of something as ripe as the AWS system. Third, Amazon has the motivation, due to number 1, to keep on top of and ensure that its technique is sound and robust. Not only that, it has the resources to do it. Four, the technique is open, and documented, and available to all. No skullduggery is required at an algorithm level to analyze it and understand it. Thesis seeking white hat PhD students can have at it and advance the field. So, if there were to be "one algorithm", Amazon and AWS have the experience and know how to hold theirs up high on a pedestal labeled "You could do a lot worse".
edoceo 5y ago
I'm using signatures, influenced by AWS and ActivityPub specs for some of our APIs. But I'm using Sodium for the hashing/signing.
et1337 5y ago
We use a flavor of SigV4 for our REST and gRPC APIs at StrongDM[1] [1] https://www.strongdm.com/ https://www.strongdm.com/

jaytaylor 5y ago

Is there a benefit to companies all using the exact same web service request signature scheme? One downside is that it would make widespread web service API abuse even easier than it already is. One would need to understand even less about the mechanics and workings of same-scheme services across companies. Yes, this is security through obscurity, but why leave more surface area open than necessary? Malicious actors will certainly appreciate it!

whartung 5y ago
> Is there a benefit to companies all using the exact same web service request signature scheme? Well, there's some things to consider. First, Amazon AWS is a very rich target. It hosts a very large quantity of services that would be ripe for exploitation. I'm sure attackers would love to find holes in the AWS mechanism. Second, because of number 1, I'm sure the AWS services are not only a prime target for attack, but also actively being attacked. By both nefarious black hat ne'er do wells, to state level agencies. I would fully expect US, Russian, Chinese and other state intelligence agencies to be very interested in an exploit of something as ripe as the AWS system. Third, Amazon has the motivation, due to number 1, to keep on top of and ensure that its technique is sound and robust. Not only that, it has the resources to do it. Four, the technique is open, and documented, and available to all. No skullduggery is required at an algorithm level to analyze it and understand it. Thesis seeking white hat PhD students can have at it and advance the field. So, if there were to be "one algorithm", Amazon and AWS have the experience and know how to hold theirs up high on a pedestal labeled "You could do a lot worse".

edoceo 5y ago

I'm using signatures, influenced by AWS and ActivityPub specs for some of our APIs. But I'm using Sodium for the hashing/signing.

et1337 5y ago

We use a flavor of SigV4 for our REST and gRPC APIs at StrongDM[1] [1] https://www.strongdm.com/ https://www.strongdm.com/