I'm wondering whether an HTTPS API endpoint would be as secure as or more secure than SSH.
- The API endpoint would require HTTPS
- The API authentication would use a POST'd API key.
- The minimum required length of the API key could basically be arbitrarily long
- The API endpoint would only accept connections from whitelisted IP addresses.
- The API endpoint's URL would not be publicly available or linked from anywhere. Only the client application would know what it was.
- The client application connecting to the endpoint will not accept weak SSL cyphers.
For the purposes of this question, we'll make the following assumptions about the SSH connection that we're comparing to.
- The minimum required password length is 8 characters with upper case, lower case, and number required.
- The domain that you connect to is the public facing domain (i.e. for http://domain.com you connect using ssh domain.com)
Some considerations that I've thought of which may affect whether or not one is more secure than the other are:
- Is HTTPS's detection of IP address as reliable as how SSH does it? I'm guessing both of them just look at what the client sends them and therefore can't be 100% trusted, but nevertheless provide some level of security.
- I believe that SSH has a built in mechanism to prevent rapid retry attempts. I know that HTTPS by itself doesn't do that, but in many cases where security is paramount that it built into the web serve layer.
My hunch would be that the API endpoint would actually be more secure than SSH for the following reasons - but I'm not a security expert by any stretch, so I'd love to get a solid answer:
- With SSH, the potential attacker knows what domain to target (i.e. ssh domain.com). But with the API, the URL would not be known so in order to even begin to try to attack it, they'd first have to figure out what the URL was.
- The API password strength is greater
The reason I'm asking this is that I'm considering building an API endpoint that would allow a trusted, authenticated user to access a lot of potentially sensitive data. It would be a powerful tool that would allow for nicely decoupled application business logic to be written very quickly.
The reason why I'm asking whether it's as secure as SSH is because my assumption is that potential users for this application have SSH enabled with at most an IP address whitelist as an additional layer of security.
So that is to say that the capabilities of this API endpoint are already present via SSH. If the endpoint would present no additional risk over and above the risk that is present with SSH, then I would consider that an acceptable level of risk. But if it were less secure, then I would most likely not consider it acceptable.
UPDATE: Added note about weak cyphers to API endpoint.