3 ms·
Can you explain why one shouldn't use HMAC signatures to sign requests? How else can you guard against replay attacks, and authenticate the request? Only a key
by Rygu 13y ago
Can you explain why one shouldn't use HMAC signatures to sign requests?
How else can you guard against replay attacks, and authenticate the request? Only a key isn't enough, you need secrets as well. Right?
- poutine 13y agoYou're only using SSL which protects you vs relay attacks (it's doing its own MAC). Authentication is being done through the HTTP request Authorization header and the attached pre shared key. Use SSL only, tune ciphers and you're good. You're wasting time trying to overthink the problem by adding another layer on top.
- ryan-c 13y agoThe problem is that it is very common for SSL client libraries to neglect to validate the peer certificate...
- poutine 13y agoIf you use a broken library then you're in trouble no matter what MAC wizardry you layer on top of it. You've got a core issue that is a better place to spend time solving that coming up with some sort of MAC layer to add on top.