StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POAPI authentication design and hackability
primarykey
Id
1634425
data
AcceptedAnswerId
1634518
AnswerCount
4
ClosedDate
CommentCount
0
CommunityOwnedDate
CreationDate
2009-10-28T00:03:16.390
FavoriteCount
11
LastActivityDate
2014-08-17T21:01:09.947
LastEditDate
2014-08-17T21:01:09.947
LastEditorUserId
2246344
OwnerUserId
106717
ParentId
0
PostTypeId
1
Score
8
ViewCount
1724
LastEditorDisplayName
text
Body
Question: Is this API authentication technique easily hackable? <pre><code>apiKey = "123456789" apiCallId = "1256341451" apiSecret = "67d48e91ab2b7471d4be2a8c2e007d13" sig = md5(apiKey + apiCallId + apiSecret) = 09c297a354219f173bfc49c2e203ce03 </code></pre> where <ul> <li><code>apiKey</code>: some unique identifier for the user</li> <li><code>apiCallId</code>: a unique integer that must be increasing in value (e.g. UNIX time stamp)</li> <li><code>apiSecret</code>: string known only to the user, and us - not passed in URL</li> <li><code>sig</code>: "unhackable" signature of this API call - MD5 hash</li> </ul> Example API call: <pre><code>http://api.domain.com/?apiKey=123456789&apiCallId=1256341451&sig=09c297a354219f173bfc49c2e203ce03&param1=x&param2=y </code></pre> This API does not require a session, and is not designed for a 3rd party to use on behalf of a user. Instead, it is to be used by the user themselves. I really like the simplicity of this. The requirement of <code>apiCallId</code> being unique, and always increasing means reusing a <code>sig</code> is not possible, so I feel like it is secure (protected against replay attacks), but I am not an expert. Other APIs use all of the GET parameters sorted alphabetically when calculating the <code>sig</code>, but I do not see why this is necessary when including <code>apiCallId</code>. Please try and hack this now before it is implemented and released. I welcome any feedback, suggestions and security education.
Tags
<api><security><authentication><cryptography>
Title
API authentication design and hackability
singulars
PostAcceptedAnswerId
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
PostParentId
1. This table or related slice is empty.
PostTypePostTypeId
1. PTQuestion
UserLastEditorUserId
1. USSam
UserOwnerUserId
1. USPeter Sankauskas
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. PL
 singulars
 LinkTypeLinkTypeId
 LTLinked
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
2. PO
 singulars
 PostTypePostTypeId
 PTAnswer
3. PO
 singulars
 PostTypePostTypeId
 PTAnswer
VotesPostIdCreationDate
1. VO
 singulars
 PostPostId
 POAPI authentication design and hackability
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
2. VO
 singulars
 PostPostId
 POAPI authentication design and hackability
 UserUserId
 USbobber205
 VoteTypeVoteTypeId
 VTFavorite
3. VO
 singulars
 PostPostId
 POAPI authentication design and hackability
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
CommentsPostId
1. This table or related slice is empty.

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.