On: Secure Your REST API

[dllthomas]

Shouldn't HTTP Digest still be preferred, so your server doesn't need to see the passwords?

[tptacek → dllthomas]

That's not how HTTP Digest auth works, and you should never, ever be using "passwords" for API authentication.

[dllthomas → tptacek]

Are you saying the server sees the password in HTTP Digest authentication?

[jimktrains2 → dllthomas]

How else would the server know what to check your response against? If you don't want to give the server a password, try SRP.

[tptacek → jimktrains2]

... but please don't use SRP for your API authentication.

[dllthomas → jimktrains2]

Well, in this case (having gone back and actually checked the docs rather than relying on recollection roughly a decade old) you could store MD5(username:realm:password) rather than password, though that doesn't buy you all that much in a case like this where making the password a long, random string that's not reused is not only good practice but also easy and so likely to be general practice.

[tptacek → dllthomas]

Stipulating all the other points you've made, exactly what is the purpose of hiding from a server a long random string generated by that server and useful only to that server?

[jimktrains2 → tptacek]

Preventing someone else from getting that and using it on the server, especially if the service can rack up charges.

[dllthomas → jimktrains2]

If you have the hash, you can log into the site (just not using the typical libraries), so it really doesn't add a lot of security. That's why I was wrong :-P

[dllthomas → tptacek]

Yeah, I got there, just was confused about the digest thing.