I thought that if TLS is well implemented that is sufficient for security.
Today I analyzed PubNub (Global Data Stream Network) and found these steps for security:
- communication over TLS
- AES-256 to encrypt & decrypt data
- and message-signing with HMAC
Isn't it redundant and unnecessary to use the second and third step ? I thought that TLS is an all in one solution.
Please recommend me some books related to this topic.
I want to implement a mission critical service for thousands of people and I want to learn how to do it properly before I begin.