Re:Secure database-driven applications on Neocities
by placeybordeaux on Thursday July 06, 2017 @06:21PM
(#14714428)
Would you consider my private keys secure if I posted them here and said that I would rotate them as soon as someone uses them in a way I don't like?
Re:Secure database-driven applications on Neocities
by jchanimal on Thursday July 06, 2017 @08:31PM
(#14715087)
It's common for client applications to encode a client secret. Many API client apps use a model like this, for example Firebase calls their equivalent token an API Key.
The "secret" in this case is really being used to select a context. So the secret you'd embed in your copy of the app would differ from mine, and it would point to your database, not mine.
Many signup forms don't even have the equivalent of the first secret. It's purpose is more as a client identifier than a genuine secret. If a malicious client were to grab that published secret, the web service author could rotate keys and put a new secret in the HTML, and rate limit the attacked secret.