Messages via JSON

#1

Post by teko_ji » Wed, Oct 23, 2019, 6:22 PM UTC

Re: Messages via JSON

#2

Post by Andrew_nenakhov » Wed, Oct 23, 2019, 6:31 PM UTC

What's the point? Why not just forward a message to XMPP, Telegram, WhatsApp or email? You know, to the app users actually use. Why make them install one more quasi-messenger?

Re: Messages via JSON

#3

Post by teko_ji » Wed, Oct 23, 2019, 6:35 PM UTC

Andrew_nenakhov wrote: post #2

What's the point? Why not just forward a message to XMPP, Telegram, WhatsApp or email? You know, to the app users actually use. Why make them install one more quasi-messenger?

Because they don't work directly with web services. Read the author's article: https://medium.com/@re_dmitriy/what-is-refl-me-67e6eb151f27

Re: Messages via JSON

#4

Post by Andrew_nenakhov » Wed, Oct 23, 2019, 6:38 PM UTC

teko_ji wrote: post #3

Andrew_nenakhov wrote: post #2

What's the point? Why not just forward a message to XMPP, Telegram, WhatsApp or email? You know, to the app users actually use. Why make them install one more quasi-messenger?

Because they don't work directly with web services. Read the author's article: https://medium.com/@re_dmitriy/what-is-refl-me-67e6eb151f27

> The application with the required frequency directly checks JSON on the web service side

How charming.

Re: Messages via JSON

#5

Post by joan453 » Wed, Oct 23, 2019, 6:41 PM UTC

Simple and interesting idea!

Re: Messages via JSON

#6

Post by teko_ji » Wed, Oct 23, 2019, 6:43 PM UTC

Andrew_nenakhov wrote: post #4

teko_ji wrote: post #3

Earlier quoted context omitted.

Because they don't work directly with web services. Read the author's article: https://medium.com/@re_dmitriy/what-is-refl-me-67e6eb151f27

> The application with the required frequency directly checks JSON on the web service side How charming.

What's wrong with that?

Re: Messages via JSON

#7

Post by beefhash » Wed, Oct 23, 2019, 6:49 PM UTC

> Request signature format(crc): [time_stamp]_[md5(time_stamp+secret_key)]

This should probably be an HMAC construction at the very least, and MD5 in general just should be discarded entirely in favor of BLAKE2b, SHA-2 or SHA-3. And ideally, it'd actually validate the rest of the contents as well.

Re: Messages via JSON

#8

Post by teko_ji » Wed, Oct 23, 2019, 6:53 PM UTC

beefhash wrote: post #7

> Request signature format(crc): [time_stamp]_[md5(time_stamp+secret_key)] This should probably be an HMAC construction at the very least, and MD5 in general just should be discarded entirely in favor of BLAKE2b, SHA-2 or SHA-3. And ideally, it'd actually validate the rest of the contents as well.

I think the author has made it as simple as possible for users and developers with basic skills.

Re: Messages via JSON

#9

Post by beefhash » Wed, Oct 23, 2019, 6:55 PM UTC

teko_ji wrote: post #8

beefhash wrote: post #7

> Request signature format(crc): [time_stamp]_[md5(time_stamp+secret_key)] This should probably be an HMAC construction at the very least, and MD5 in general just should be discarded entirely in favor of BLAKE2b, SHA-2 or SHA-3. And ideally, it'd actually validate the rest of the contents as well.

I think the author has made it as simple as possible for users and developers with basic skills.

While I agree with the notion of making things simple, security theater is worse than no security at all because it makes you feel safe when you may not be.

Re: Messages via JSON

#10

Post by Leace » Wed, Oct 23, 2019, 6:56 PM UTC

teko_ji wrote: post #6

Andrew_nenakhov wrote: post #4

Earlier quoted context omitted.

> The application with the required frequency directly checks JSON on the web service side How charming.

What's wrong with that?

Not the poster but it may be useful to know that Andrew_nenakhov is a CEO of company that provides a Jabber messanger (Xabber).