1

I'm a customer of a big KYC provider and am using their API. The process to authenticate at the API requires a secret key that they are sending to me by email. If I want to revoke the key and get a new one I have to send a mail to their support, and they send me a new one.

This feels pretty weird, and if any company handled my password like that I would be very worried. Is it ok/normal to handle API keys like that? If anyone gets access to them they don't even need to know my account name to use the API with my account.

3
  • 2
    It depends on the sensitivity of the key
    – schroeder
    Apr 27, 2023 at 15:57
  • How much a key needs to be protected depends on how secure your mail account is and how much harm can be done when misusing the key - none of this is known. Apart from that the security need to protect a key cannot be directly compared to a password - a password is chosen by you, the key by the provider. A password is often weak and reused - a key not. Apr 27, 2023 at 16:40
  • Encrypting the key before sending would be a substantial security upgrade.
    – ThoriumBR
    Apr 27, 2023 at 17:33

1 Answer 1

1

In my experience, that is not normal. There are a few reasons I can think of.

  1. I have never encountered that with any large provider (eg, Amazon Web Services, Google, Facebook), so it is atypical in that sense, and possibly for good reason.
  2. It sounds as though an employee is responding to your email, meaning that human could use the API key they are sending you. Sure, that human probably already has access to mess with your account, but they don't necessarily have the ability to impersonate you via the API key they just emailed you. There is a big difference in the case that something goes wrong, which is the case everyone probably cares about: the owner (you) will be seen as the entity that took action when something goes wrong.
  3. Your API key is now also potentially stored in the employee's email. That employee is more surface area that can be subjected to an over-the-shoulder style of attack (eg, they are doing work in public, or leave their laptop opened/unlocked, etc.). In addition, your API key is now subjected to someone just stealing their phone and then possessing your API key. Ideally, you'd want secrets of any kind, of any importance, stored in the minimal amount of places and certainly only the expected/designated places (eg, the company's database and your config files).
  4. This is less of a risk, but it is also now in your email, which you may or may not have control over. For example, your email provider may have backups that you aren't aware of and that many people you do not know have access to. This is less of an issue in my opinion because--assuming it was transmitted via a secure email--it is your responsibility to protect your email. That being said, by emailing you the API key, they've forced you to deal with the repercussions of that.

All that being said, I would also say that it is qualitatively different from a long-term password, because passwords are generally understood to be secrets with relevance to the owner of the password. If the password does have significance to you, then it is irreplaceable because a secret of your mind has been compromised. API keys are generally thought of as being random and disposable, and a password is often required to generate them. The API key never came from your mind, so nothing about you has been exposed.

So, even though either one being compromised may lead to the same access in any given system, there is that different in meaning. A possible analogy for those of us in the USA is like having your Social Security Number (SSN) compromised compared to your credit card number compromised. The end result may be that someone has spent money on your behalf, but having your SSN exposed is usually a larger issue than just getting a new credit card number.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .