News for hackers. Stuff that matters.

A comment on API responses should be signed. Parent comment

Re:API responses should be signed by edent on Monday January 20, 2020 @02:56AM (#22097190)
You have it wrong. I also thought that was the answer. See these responses to my question on StackExchange https://security.stackexchange.com/questions/193559/saving-a...
[ Parent | on HN ]
Re:API responses should be signed by jayd16 on Monday January 20, 2020 @03:09AM (#22097243)
Looks like the message is encrypted with a key derived by both parties but this produces a symmetric encryption. The client then has the ability to spoof encrypted server communications.
[ Parent | on HN ]