Monthly Archives: January 2009

A Different Model For Web Services Authorization

By Ian McKellar | January 5, 2009

In my last post I set out to describe how easy it is to extract private keys from desktop software. As I was concluding I stumbled on an alternative approach that might be more secure in some circumstances. I didn’t really go into details, so here’s an expansion of the idea.
Current API authentication mechanisms including [...]

Posted in Default | Tagged , , , | 8 Comments

No More Secrets

By Ian McKellar | January 5, 2009

Using secret keys to identify applications communicating across the internet has become popular as people have copied the very successful Flickr authentication API. Unfortunately people trust that they can keep these keys secret from attackers, even as they distribute applications that contain the secret keys to other people. I decided to see how hard it [...]

Posted in Default | Tagged , , | 8 Comments