A Child’s Garden of Inter-Service Authentication Schemes • Hacker News Board

Re: A Child’s Garden of Inter-Service Authentication Schemes

#51

Post by jessaustin » Wed, Jun 13, 2018, 3:49 PM UTC

bullen wrote: post #48

jessaustin wrote: post #34

Earlier quoted context omitted.

Which hash are you using? All this would be for naught if it's one of the many susceptible to length extension attacks; e.g. SHA2. This is the reason everyone uses HMAC now.

The salt is not attacker-controlled.

I thought the left column above was the client/attacker? She doesn't actually have to use the salt you send her...

[EDIT:] Actually never mind. I'm sure this is all fine, and look how much more efficient this 3-way back-and-forth conversation is than any conventional auth scheme would be. You should design all your own auth.

Re: A Child’s Garden of Inter-Service Authentication Schemes

#52

Post by pvg » Wed, Jun 13, 2018, 3:51 PM UTC

lvh wrote: post #50

pvg wrote: post #47

Earlier quoted context omitted.

Yep, that makes sense. I'm having a bit of a 'oh, so that's why' moment while also feeling a little envious of a subfield where 'the inadequate size of your budget' is a viable starting point for a constructive conversation with a client.

That's an argument from/with random people on the Internet, not clients. The nice thing about being around clients for a long time is that you build a working relationship with them based on mutual trust and respect. That said, adequately informing clients of risk and dissuading them from nightmare projects they don't realize are nightmare projects yet is doing your clients a service. Sometimes that means advising th…

Hah, yes it was a dumb joke more than anything else. I do want to tip my hat and encourage you to write more of these, they are materially useful as reference in places beyond message board threads and contrived 'worst client ever' quips.

Re: A Child’s Garden of Inter-Service Authentication Schemes

#53

Post by closeparen » Wed, Jun 13, 2018, 4:08 PM UTC

sarcasmic wrote: post #11

If you're like me and are wondering what Macaroons are, some searching revealed to me that this is the 2014 paper [1] that introduced them to the public. It's a nested, chained HMAC construction that's useful for delegation, and here's a library and some code examples [2] that one can play with to get a feel for what they do and how. No wonder it's not well known: it hasn't been picked up by the blog treadmill where…

How would a service come into possession of a Macaroon good for another service? I could see getting a macaroon for a username/password/2FA in a frontend context, but how does it solve backend service authentication?

Re: A Child’s Garden of Inter-Service Authentication Schemes

#54

Post by sytringy05 » Wed, Jun 13, 2018, 11:27 PM UTC

pvg wrote: post #52

lvh wrote: post #50

Earlier quoted context omitted.

That's an argument from/with random people on the Internet, not clients. The nice thing about being around clients for a long time is that you build a working relationship with them based on mutual trust and respect. That said, adequately informing clients of risk and dissuading them from nightmare projects they don't realize are nightmare projects yet is doing your clients a service. Sometimes that means advising th…

Hah, yes it was a dumb joke more than anything else. I do want to tip my hat and encourage you to write more of these, they are materially useful as reference in places beyond message board threads and contrived 'worst client ever' quips.

I agree, this sort of discussion is invaluable. Thanks!