API responses should be signed

Re:API responses should be signed by greatjack613 on Monday January 20, 2020 @02:20AM (#22097002)

Cool concept but totally overblown need.

If the usage for api signing is to verify that leaked private messages are legit then I don't think we should have such tech in place.

If anyone has any more legitimate use cases that auth does not account for I would love to hear.

[ Parent | on HN ]

Re:API responses should be signed by edent on Monday January 20, 2020 @03:05AM (#22097234)

Here are a few that I considered including in the post...

The city's car park API told me I could park here - why have I been given a parking ticket?

The hospital's drug API told me I could mix these two tablets.

The bank's API told me a client hadn't received the funds I sent.

Basically, if I have to go to court and say "I have proof that your system told me XYZ."

[ Parent | on HN ]

Re:API responses should be signed by DarkWiiPlayer on Monday January 20, 2020 @08:20AM (#22098581)

Better yet:

Someone sends you a tweet with your address, a picture of your house and a picture of a gun, then deletes the tweet the next day.

[ Parent | on HN ]