News for hackers. Stuff that matters.
Re:API responses should be signed by raxxorrax on Monday January 20, 2020 @03:44AM (#22097394)
I think there could be a case made based on the fact that the HTPPS connection isn't necessarily established by the service you want to connect to. Especially in the cloud world where TLS can be terminated on a load balancer or similar network service instead of the service you wanted to address. This assumes threats between these two services, similar to what the author describes as manipulation by intermediaries.

In this case the author criticizes manipulation of the content by third parties. I hope this is not another argument for a digital notary and believe that there are better technical solutions to that problem. Digital ledgers seem to be a niche some people try to establish.

In the end HTTPS is just transport encryption, not content encryption or content signing.

From an architecture point of view I think it is even advantageous if not every services handles HTTPS itself.

There are no comments on this comment yet.