Reputation
Top tag
Next privilege 125 Rep.
Vote down
Badges
6
Impact
~2k people reached

  • 0 posts edited
  • 0 helpful flags
  • 2 votes cast
May
7
comment Vulnerable code suggested on OWASP?
Consider someone with a mobile phone (or tethered laptop) using your app while on a commuter train. Won't they have multiple IP addresses during the trip?
Sep
24
awarded  Autobiographer
Mar
17
answered How to react when under attack
Mar
17
revised What are practical risks of http (not https) in server-to-server communications
edit 2
Mar
17
awarded  Citizen Patrol
Feb
12
awarded  Popular Question
Dec
4
awarded  Student
Feb
25
comment What are practical risks of http (not https) in server-to-server communications
Regarding "how much will it cost you if someone steals data from company a or company b - if its more than the cost of buying a cheap SSL cert then it's justified." Respectfully, I do not believe a proper model can be that simple. Is it not also a function of the probability of compromise? This was the thrust of the question "How does one reason about the associated risk?"
Feb
25
comment What are practical risks of http (not https) in server-to-server communications
That is for the consumer site, I assume. My (non-rigorous!) experiment just now with a call to an API endpoint does not appear to redirect to SSL. And the "key" this API wants includes a username and password (!). Anyway, even if it did redirect, the damage would have been done.
Feb
25
comment What are practical risks of http (not https) in server-to-server communications
@Kyle - not sure why asking this question is a facepalm ( which I had to look up: urbandictionary.com/define.php?term=face%20palm ). Care to speculate as to why these high profile sites allow their API keys to travel in the clear?
Feb
25
awarded  Supporter
Feb
25
comment What are practical risks of http (not https) in server-to-server communications
Thank you for the response. Why do you think Posterous et al allow their callers to expose a key in the clear? I can only guess they did some cost/risk tradeoff and decided it was okay to allow. Other APIs, such as from Twitter and Twilio, only appear to offer secure endpoints.
Feb
25
comment What are practical risks of http (not https) in server-to-server communications
+1 for PROBABLY comment since security is a trade-off [“Security is always a tradeoff; it must be balanced with the cost.” - Bruce Schneier]. Interestingly, Posterous, et al, do expose a key that can be used to make changes on behalf of user, not just view public data. I appreciate the links. It is not that I don't understand encryption, it is that I am trying to understand the risk. My "How does one reason about the associated risk?" question in my post speaks to my curiosity around how to model it. Modeling requires cost of loss (which I did not specify) + chance of loss (big question).
Feb
24
awarded  Editor
Feb
24
revised What are practical risks of http (not https) in server-to-server communications
added add'l context about existing public apis that do this
Feb
24
asked What are practical risks of http (not https) in server-to-server communications