Tagged Questions

2
votes
1answer
99 views

User Authentication API

I'm developing a web API for a user database that will be used to verify a given username / password combination is valid. I'm just looking for comments / criticism on the following method that I'm ...
3
votes
4answers
475 views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
0
votes
1answer
123 views

Securing communication

The problem: I have an open-source client (a Firefox add-on written in JavaScript) and a server containing somewhat sensible user information: username and user history (all from YouTube). The client ...
1
vote
1answer
421 views

How to implement WSS UsernameToken when password on the server is salted and hashed?

I'm currently trying to write a web service for customer and requirement is to use WS Security. On their server side, they have passwords stored as SHA-1(salt+password). According to WSS spec, ...