4 ms·
They are using TLS to assume that the client authenticates the server is who it says it is -- if you can man in the middle TLS, there are lots of other possible
by pquerna 15y ago
They are using TLS to assume that the client authenticates the server is who it says it is -- if you can man in the middle TLS, there are lots of other possible exploits besides this signature one.
- bromley 15y agoThanks. It's not clear to me from the post that it's using TLS but that would make sense. Though if requiring TLS I wonder why not just use basic auth since it's simpler and since TLS would protect the password. One of the things that's neat about, say, OAuth's MAC authentication, is that it works over plain old HTTP without TLS. Likewise for the AWS API's signature-based security scheme. Sounds like I erroneously assumed that this was aiming to do similarly.