335 reputation
149
bio website
location Glasgow, United Kingdom
age
visits member for 1 year, 10 months
seen Apr 11 at 15:12

Mar
20
awarded  Good Question
Jan
9
awarded  Famous Question
Oct
9
awarded  Notable Question
Jul
31
awarded  Nice Question
Jul
31
awarded  Nice Question
Jun
7
awarded  Yearling
May
18
awarded  Notable Question
May
17
awarded  Popular Question
Mar
29
comment Would introducing client certificates for a mobile app improve security?
Interesting, this is exactly what I am doing at the minute. When a user registers the server generates a public/private (aka API/Secret) key which is sent back to the client all over SSL. The public key is then sent as a header in the request and the private key is used to generate a signature (based on the request data). The server then uses the public key to locate the user, uses the secret stored on the server to re-generate a signature (using request data), if the signatures match, the request is authorised. Both keys are stored on the client securely in a keystore.
Mar
27
comment Would introducing client certificates for a mobile app improve security?
Isn't it a valid case though to have a server which is also a CA? Essentially what I am trying to achieve here is from the servers POV, make sure I only accept requests that come from my mobile app (I thought client certs would have been the solution to this). From the clients POV, I want to make sure I am talking to the correct server. Could you suggest a robust way of solving this issue without using client certs?
Mar
24
asked Would introducing client certificates for a mobile app improve security?
Feb
22
awarded  Popular Question
Sep
17
accepted How should API keys be generated?
Sep
8
comment How should API keys be generated?
what do you make the following approach?
Sep
6
comment How should API keys be generated?
So really I need to either sacrifice some security for usability or vice versa. I guess the other option would be to try get the balance right i.e. invalidate API keys often to force the users to re-authenticate their credentials and generate a new key. How does using client certs mitigate this problem though? Wouldn't it be the same issue if the client has the certificate on the device, couldn't that itself be extracted and used?
Sep
6
comment How should API keys be generated?
In my scenario I have SSL, but no client certs. So I need to send this "API" (or "password") key to the client. I keep a copy of this stored at the server and for every request made by a client they sign it using the "API" key and the server can use that key to lookup the client & then validate the request. The only security risk I see here is I need to store the API key on the client somewhere (mobile app) which could potentially be extracted and re-used?
Sep
6
comment How should API keys be generated?
Am I right in saying if I was to implement client certs then I wouldn't even need an "auth" token at all?
Sep
5
comment How should API keys be generated?
The API is running over SSL and I actually use the Basic authentication approach for the initial request. However, I need to store an authentication token on the client side to be used for subsequent requests. I am aware using SSL would mitigate MitM/Replay attacks as the channel is encrypted, however, this won't prevent someone from forging a request....right?
Sep
5
accepted Token-based authentication - Securing the token
Sep
5
asked How should API keys be generated?