Viewing profile — lhazlewood

HMAC authentication requires both the client and the server to have a shared secret (or more likely a derived key based on a shared secret). The secret cannot be saved as a one-way…

I gathered as much. But in practice, how often do you see RFC 2617 Digest authc used in non-browser scenarios? (I'm genuinely curious. I haven't seen it used much at all outside of…

Totally agree. The key here is that you're doing the work to implement the algorithms, not your customers. If they had to do it, they probably just wouldn't use it.

You shouldn't ever use username/password pairs for API authentication. If the user ever changed their password, then their API calls would immediately fail! This is one of many ben…

Stormpath's custom scheme is very similar to Amazon's. But per the blog article, you'd only want to do this if you are willing to support client libraries/sdks that implement it as…

Depends on the UA (curl?)

There are many types of digest authentication - OAuth1.0a and Amazon's and Stormpath's custom schemes are examples. Browser-specific digest authentication wasn't covered however si…

A UUID is first and foremost a 128 bit number, irrespective of its text encoding. Its 'canonical' form uses HEX-only encoding. A 'Url62' can be another encoding. 'Url62' wouldn't b…

Depends on the customer - if it is a government agency and SHA2 is mandated for their own passwords (per NIST standards), we comply (with a huge number of iterations based on CPU/G…

Great questions. With regard to CSPNG, this SO post answer is good: http://stackoverflow.com/questions/536584/non-random-salt-fo... As for bcrypt/scrypt vs iterations, there is a d…

BCrypt (level 3) is getting the basics right. Levels 4 and 5 are techniques beyond the basics used to minimize potential brute force attacks, which _are_ an issue, depending on the…