Many API's I found that using same method for authentication:
Signature is a HMAC-SHA256 encoded message containing nonce, customer ID (can be found here) and API key. The HMAC-SHA256 code must be generated using a secret key that was generated with your API key. This code must be converted to it's hexadecimal representation (64 uppercase characters).
I believe that for making it works, the service provider must keep a copy of the API secret, and then he can check if the user used the same secret to generate the signature.
I'm thinking that it is very insecure, and it is like storing a plain password in the database. Anyone who get an old database backup have the secrets of all the users.
Am I miss something? There is a method for the server, to check that the user encoded a signature using specific secret, without storing the secret in the database?
Because of this, I think to provide the user a private key of OpenPGP pair, and then I can validate the signature using the public key.
Do you think, that there is a security flaw in the way bitstamp for example, working, and OpenPGP would be better?