4 ms·
Thanks! I understand the Amazon vulnerability fully, I was just referring to my own web-app development. It's not an issue though because I don't do the key/v
by kirse 18y ago
Thanks! I understand the Amazon vulnerability fully, I was just referring to my own web-app development.
It's not an issue though because I don't do the key/value pair splitting as they do.
- tptacek 18y agoWhy are you "signing" your data at all? You're doing it wrong. Use SSL to secure the whole transport; use form or HTTP auth to make sure you know who you're talking to.
- deleted 18y ago[deleted]
- cperciva 18y agoSigning requests with an HMAC provides end-to-end authentication, which is vastly superior to transport-level authentication such as HTTP auth.
- tptacek 18y agoYou skipped the HTTPS part of my recommendation, which is vastly superior to homebrewed HMAC.
- cperciva 18y agoHTTPS is irrelevant to what I said. End-to-end authentication is better than transport-level authentication. Using an HMAC to sign requests and then sending those signed requests over HTTPS is better than using HTTP auth over HTTPS.
- tptacek 18y agoYes, but what you said is irrelevant to what I said, and so we are at an impasse. =)