News for hackers. Stuff that matters.

A comment on Ask HN: What's the recommended method of adding authentication to a REST API?. Parent comment

Re:Ask HN: What's the recommended method of adding authentic... by comradesmith on Tuesday January 16, 2018 @06:22AM (#16157392)
HTTP Basic authentication should never be used, it is very vulnerable to traffic analysis attacks. HTTP Digest authentication however, would be a perfectly fine solution.
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by dozzie on Tuesday January 16, 2018 @06:29AM (#16157410)
How so? Over SSL? (Note that you should never call anything requiring authentication/authorization over plain HTTP.)
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by comradesmith on Tuesday January 16, 2018 @06:39AM (#16157451)
A quick Google suggests you're right, as in either case you must run SSL/TLS.

Appypolylogies.

[ Parent | on HN ]